Skip to content

Clarify that Cloudflare SSL/TLS will only work for a subdomain if the DNS record is proxied #23900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 31, 2025
Merged

Clarify that Cloudflare SSL/TLS will only work for a subdomain if the DNS record is proxied #23900

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
112097f
Update ssltls-subdomains.mdx
simon-says Jul 23, 2025
32c329f
Update limitations.mdx
simon-says Jul 23, 2025
26b9d8b
Small Style Guide adjustments
RebeccaTamachiro Jul 31, 2025
577d756
Add title to note and move it lower in the partial
RebeccaTamachiro Jul 31, 2025
dfd005f
Adjust title case
RebeccaTamachiro Jul 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/content/docs/dns/proxy-status/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ sidebar:

import { Render, Example, Details, GlossaryTooltip } from "~/components";

While your [DNS records](/dns/manage-dns-records/) make your website or application available to visitors and other web services, the **Proxy status** of a DNS record defines how Cloudflare treats incoming DNS queries for that record.
While your [DNS records](/dns/manage-dns-records/) make your website or application available to visitors and other web services, the proxy status of a DNS record defines how Cloudflare treats incoming DNS queries for that record.

The records you can proxy through Cloudflare are [records used for IP address resolution](/dns/manage-dns-records/reference/dns-record-types/#ip-address-resolution) — meaning A, AAAA, or CNAME records.

Expand Down
6 changes: 5 additions & 1 deletion src/content/docs/ssl/edge-certificates/universal-ssl/limitations.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,10 @@ import { GlossaryTooltip } from "~/components"

Universal SSL certificates present some limitations.

## Proxy status

Cloudflare can only serve an SSL/TLS certificate for a DNS record when you set the record's [proxy status](/dns/proxy-status/) to **Proxied**. If you do not do this, the origin server your record points to will be responsible for supporting SSL/TLS connections.

## Hostname coverage

### Full setup
Expand Down Expand Up @@ -60,4 +64,4 @@ Due to internal limitations, Universal SSL certificates do not cover [load balan

## Browser support

For more on browser support, see [Browser compatibility](/ssl/reference/browser-compatibility/).
For more on browser support, see [Browser compatibility](/ssl/reference/browser-compatibility/).
4 changes: 4 additions & 0 deletions src/content/partials/dns/ssltls-subdomains.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,7 @@
If your main domain is using Cloudflare's [Universal SSL certificate](/ssl/edge-certificates/universal-ssl/), that certificate also covers all first-level subdomains (`blog.example.com`).

For deeper subdomains (`dev.blog.example.com`), use a [different type of certificate](/ssl/edge-certificates/universal-ssl/limitations/#full-setup).

:::note[Proxy status]
Cloudflare can only serve an SSL/TLS certificate for a DNS record when you set the record's [proxy status](/dns/proxy-status/) to **Proxied**. If you do not do this, the origin server your record points to will be responsible for supporting SSL/TLS connections.
:::
Loading