A New Name and More Control for Cloudflare SSL Certificates

Cloudflare is replacing its Dedicated Certificates product with a more flexible offering called Advanced Certificate Manager (ACM). The upgrade gives customers granular control over certificate validity periods, cipher suites, and certificate signing requests — all from a single management interface.

Shorter Certificate Lifecycles

TLS certificates rely on public-key cryptography to encrypt data in transit and confirm a server's identity. The Certification Authority Browser Forum has progressively reduced the maximum validity period for publicly trusted certificates — down from three years to one. The logic is straightforward: rotating certificates and their associated private keys more frequently shrinks the window of exposure if a key is compromised.

More frequent rotation also encourages automation. The more often a task needs to be done, the more likely teams are to automate it, reducing the chance of an expired certificate in production or unnecessary human access to key material.

With Advanced Certificate Manager, customers can set certificate validity as short as 14 days. Cloudflare's issuance pipeline handles roughly 4.5 million certificates per day, so the increased renewal load from short validity periods is not a concern for the network.

Fine-Grained Cipher Suite Control

A cipher suite defines the algorithms used to secure a TLS connection: key exchange, authentication, bulk encryption, and message authentication code (MAC). During a TLS handshake, the client advertises its supported cipher suites in the Client Hello, and the server selects one in its Server Hello response.

Historically, Cloudflare's servers chose the cipher for connections to sites on its network, with a preference for ECDHE-based suites over RSA-based ones due to RSA's greater vulnerability if a private key leaks. Advanced Certificate Manager now exposes that decision to customers.

Through the Cipher Suite Settings API endpoint, customers can supply an allowlist of approved ciphers for TLS termination, removing weaker suites and narrowing connections to the strongest available options. OneTrust and Report URI already use this capability to meet strict internal security requirements.

Bring Your Own Certificate Authority

Some organizations need to obtain certificates from a specific authority while keeping the private key securely managed by Cloudflare. Advanced Certificate Manager supports generating a Certificate Signing Request (CSR) containing the organization name and location. Customers submit the CSR to their preferred CA, receive the signed certificate, and upload it to Cloudflare — the private key never leaves Cloudflare's network, which uses both software-based key management and hardware controls.

Scaling Up Certificate Management

Beyond the security-oriented settings, ACM expands the scale of certificate management per zone:

  • Issue up to 100 edge certificates per zone
  • Cover the zone apex plus up to 50 hostnames
  • Create certificates for second-level and third-level hostnames
  • Choose validation method: HTTP, TXT, or Email
  • Select certificate authority: Let's Encrypt or DigiCert

Configuration details are available in Cloudflare's developer documentation.

Migration From Dedicated Certificates

Existing Dedicated Certificate customers will be upgraded to Advanced Certificate Manager automatically over the next month. The migration is designed for zero downtime; users will simply see the certificate type in the dashboard change from Dedicated to Advanced.

API users must switch to the new ACM certificate issuance endpoint, which returns Advanced as the type instead of Dedicated.

Customers who already purchased Dedicated Certificates keep their current pricing. For Free, Pro, and Business plans, Advanced Certificate Manager costs $10/month per zone. Enterprise customers should contact their account team for details.