Skip to content

[SSL] Cert replacement status and Origin CA requirement #21917

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 23, 2025
Merged

[SSL] Cert replacement status and Origin CA requirement #21917

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e56e5ea
Add dedicated section for cert replacement
RebeccaTamachiro Apr 23, 2025
d8680d2
Add API Access note to Origin CA setup page
RebeccaTamachiro Apr 23, 2025
f7232b6
Apply suggestions from code review
RebeccaTamachiro Apr 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/content/docs/ssl/origin-configuration/origin-ca/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,9 @@ To create an Origin CA certificate in the dashboard:
2. Choose a domain.
3. Go to **SSL/TLS** > **Origin Server**.
4. Select **Create Certificate**.
:::note[API Access required]
Users who do not have [**API Access**](https://dash.cloudflare.com/?to=/:account/members) will receive an error while trying to perform this action. Refer to [Troubleshooting](/ssl/origin-configuration/origin-ca/troubleshooting/#this-zone-is-either-not-part-of-your-account-or-you-do-not-have-access-to-it) for guidance.
:::
5. Choose either:
* **Generate private key and CSR with Cloudflare**: Private key type can be RSA or ECC.
* **Use my private key and CSR**: Paste the Certificate Signing Request into the text field.
Expand Down
8 changes: 7 additions & 1 deletion src/content/docs/ssl/reference/certificate-statuses.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ description: Understand certificate statuses in Cloudflare SSL/TLS, including st
Certificates statuses show which stage of the issuance process each certificate is in.
## New certificates

When you order a new certificate, either an [edge certificate](/ssl/edge-certificates/) or a certificate used for a [custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/), its status will move through various stages as it progresses to Cloudflare’s global network:
When you order a new certificate, either an [edge certificate](/ssl/edge-certificates/) or a certificate used for a [custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/), its status will move through various stages as it progresses to Cloudflare's global network:

1. Initializing
2. Pending Validation
Expand All @@ -21,6 +21,12 @@ Once you issue a certificate, it should be in **Pending Validation**, but change

If you deactivate a certificate, it will become a **Deactivating** and then an **Inactive** status.

### Certificate replacement

When replacing a certificate, you may note a **Pending Cleanup** status. Old certificates are not deleted until the replacement has been successfully issued. This helps ensure TLS will not break for the hostname while the certificate is being replaced.

When the new certificate is successfully issued and activated, the status for the old certificate will transition from **Pending Cleanup** and the certificate will be deleted.

## Custom certificates

If you are using a [custom certificate](/ssl/edge-certificates/custom-certificates/) and your [zone status](/dns/zone-setups/reference/domain-status/) is **Pending** or **Moved**, your certificate may have a status of **Holding Deployment**.
Expand Down
Loading