Closing the subdomain certificate gap

Cloudflare has announced Total TLS, a one-click feature that automatically issues individual TLS certificates for every proxied subdomain on a customer's domain. The feature is designed for organizations whose DNS setups include subdomains that fall outside the coverage of a standard wildcard certificate.

By default, every Cloudflare customer receives a free TLS certificate covering the apex domain and one wildcard level — for example, example.com and *.example.com. Deeper hostnames such as a.b.example.com require separate certificate coverage. Total TLS removes that manual step by issuing dedicated certificates for each proxied DNS record automatically.

From manual issuance to automated coverage

Cloudflare's existing certificate options occupy two ends of a spectrum. Universal SSL, introduced in 2014, provides free, simple coverage for the apex and a wildcard. For customers needing more, Advanced Certificate Manager allows the issuance of Advanced certificates that can include up to 50 explicitly specified hostnames per certificate.

The limitation of the Advanced approach is that it requires customers to enumerate every hostname they want protected — a task that becomes unwieldy for organizations managing thousands of subdomains. This process is error-prone and does not scale well, particularly for larger customers who have repeatedly rejected it as a workable solution.

Total TLS addresses this by leveraging Cloudflare's position as the authoritative DNS provider. Since Cloudflare already knows which DNS records are proxying traffic through its network, it can automatically issue certificates for those hostnames without manual intervention.

How Total TLS works

Enabling Total TLS signals Cloudflare to issue individual TLS certificates for every proxied DNS record on the domain. For instance, a DNS record for a.b.example.com triggers the issuance of a certificate covering that hostname. A wildcard record such as *.a.b.example.com similarly results in a certificate for that wildcard.

  • Available as part of Advanced Certificate Manager for domains with Cloudflare as the authoritative DNS provider
  • Acts as a single toggle in the SSL/TLS settings
  • Issued certificates appear individually in the Edge Certificates table

Because Cloudflare handles Domain Control Validation (DCV) by adding the required records on the customer's behalf, both initial issuance and certificate renewal proceed without additional action from the customer.

Total TLS can be configured through the Cloudflare dashboard or via the API. Customers choose their certificate authority — Let's Encrypt, Google Trust Services, or No Preference, which lets Cloudflare select the CA automatically — before flipping the toggle to enable the feature.

New visibility warnings for uncovered records

Alongside Total TLS, Cloudflare is introducing DNS record warnings aimed at improving certificate visibility. Customers frequently do not realize when a proxied hostname lacks TLS coverage, an oversight that can lead to downtime or connection errors.

To mitigate this, Cloudflare will now display warnings whenever a customer creates, views, or edits a proxied DNS record that is not covered by an existing TLS certificate. This early notification gives customers the opportunity to obtain a certificate before a hostname goes live, preventing visitors from encountering browser security errors.