Skip to content

[SSL] Clarify criteria for HTTP validation with CHs #22868

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 5, 2025
Merged

[SSL] Clarify criteria for HTTP validation with CHs #22868

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aad3bc7
Remove loop ref to other methods from delegated-dcv
RebeccaTamachiro Jun 3, 2025
fa49f0b
Replace proxy language by hostname status and link for details
RebeccaTamachiro Jun 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions ...-saas/security/certificate-management/issue-and-validate/renew-certificates.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,20 +11,28 @@ head:

import { Render } from "~/components"

The exact method for certificate renewal depends on whether that hostname is proxying traffic through Cloudflare and whether it is a wildcard certificate.
The exact method for certificate renewal depends on whether that hostname is active[^1] and whether it is a wildcard certificate.

Custom hostnames certificates have a 90-day validity period and are available for renewal 30 days before their expiration.

## Non-wildcard hostnames

If you are using a non-wildcard hostname and proxying traffic through Cloudflare, Cloudflare will try to perform DCV automatically on the hostname’s behalf by serving the [HTTP token](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/http/).
If you are using a non-wildcard hostname and the hostname is active, Cloudflare will try to perform DCV automatically on the hostname's behalf by serving the [HTTP token](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/http/).

If the custom hostname is not proxying traffic through Cloudflare, then the custom hostname domain owner will need to add the TXT or HTTP DCV token for the new certificate to validate and issue. As the SaaS provider, you will be responsible for sharing this token with the custom hostname domain owner.
If the custom hostname is not active, then the custom hostname domain owner will need to add the TXT or HTTP DCV token for the new certificate to validate and issue. As the SaaS provider, you will be responsible for sharing this token with the custom hostname domain owner.

## Wildcard hostnames

<Render file="txt-validation_preamble" /> <br/>
With wildcard hostnames, you cannot use HTTP. In this case, you will have to use TXT DCV tokens.

<Render file="update-dcv-method" /> <br/>
<Render file="txt-validation_preamble" />

<Render file="update-dcv-method" />

After this step, follow the normal steps for [TXT validation](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/txt/).

:::note
To allow Cloudflare to auto-renew all future certificate orders, consider [DCV delegation](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/delegated-dcv/).
:::

[^1]: Meaning Cloudflare could verify your customer's ownership of the hostname and the [hostname status](/cloudflare-for-platforms/cloudflare-for-saas/domain-support/hostname-validation/validation-status/) is active.
15 changes: 0 additions & 15 deletions ...rtificate-management/issue-and-validate/validate-certificates/delegated-dcv.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,21 +17,6 @@ DCV Delegation requires your customers to place a one-time record at their autho

***

## When to use

### HTTP DCV

<Render file="http-dcv-situation" />

### TXT DCV

<Render file="txt-dcv-situation" /> <br/>

* [DCV Delegation](#setup) (generally recommended)
* [Manual](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/txt/)

***

## Setup

To set up Delegated DCV:
Expand Down