Why certificate changes fail in production
TLS certificates do more than encrypt traffic — they build trust between your service and its clients. When organizations manage certificates themselves, renewal is their responsibility, and mistakes can take a site or API offline. Two failure scenarios are common.
The first is incomplete coverage: a renewed certificate may omit a subdomain that was present in the previous one. The second involves certificate pinning. Pinning lets application owners instruct clients to trust only a specific certificate or public key. That strictness backfires when the pinned certificate is replaced: renewals, configuration errors, or forgotten updates can leave pinned clients refusing connections entirely. Certificate Transparency Monitoring can alert you to newly issued certificates, but it cannot prevent a bad deployment.
All of this means that for customers who rely on custom certificates — especially those using pinning — a certificate swap is risky enough to warrant testing before real users ever see it.
Staging certificates for Enterprise customers
Cloudflare now offers Enterprise customers the ability to test custom uploaded certificates against a staging network before pushing them to production. This is not a production replica; it is a separate environment that serves your certificate configuration but is reachable only through dedicated staging IPs.
To use it, navigate to the Staging Certificates section under the SSL/TLS tab in the Cloudflare dashboard and upload the new certificate. The staging network mirrors your production setup, so you can verify behavior without exposing anything to real traffic.
Validating and rolling back
Once the certificate is uploaded, you can issue curl requests against the staging IPs to confirm that the certificate is being served and that it covers every hostname it should. For customers using pinning, this environment is a place to test that pins reference the new certificate correctly and that TLS termination succeeds.
Testing does not always go perfectly, and the feature accounts for that. If a staged certificate fails verification, you can disable it and roll back to the certificate you were previously serving. The disabled certificate can then be moved back to staging for further testing, and once you are confident it works, you can promote it to production again.
Staging certificates is currently in beta and available to Enterprise customers. To enable it, contact your Account team.
What staging could cover next
The intent behind this feature is to reduce risk for all configuration changes, not just custom certificate uploads. Cloudflare plans to extend staging to cover renewals for certificates issued through Cloudflare, as well as TLS configuration changes such as minimum TLS version and cipher suite settings. Until those become available, customers with specific testing needs can reach out to their Account team.
