Renew

Custom hostname certificates have a 90-day validity period and are available for renewal 30 days before their expiration.

The validation method selected when you create a custom hostname applies to initial certificate issuance. During an Automated Certificate Management Environment (ACME) renewal, Cloudflare selects a method based on the hostname's current configuration and eligibility.

You can explicitly change the method through the API. DigiCert uses a separate renewal workflow.

Cloudflare can automatically renew a custom hostname certificate through HTTP validation when all these conditions are true:

• The custom hostname is not a wildcard.
• The hostname is active.¹
• The hostname points to the SaaS provider.
• The hostname traffic is proxied through Cloudflare.
• The hostname does not use Delegated DCV.

Cloudflare may use HTTP validation even if you selected TXT for initial issuance.

If automatic HTTP validation is unavailable, retrieve the custom hostname's current ssl.method and ssl.validation_records. Share the required HTTP or TXT records with the domain owner.

Wildcard hostnames cannot use HTTP validation. They must use TXT validation.

Non-wildcard hostnames with properly configured Delegated DCV also remain TXT-based. Keep the delegation CNAME record in place for future renewals.

For manual TXT validation, use each certificate order's current ssl.validation_records. These records can change between certificate orders.

These tokens can be fetched through the API or the dashboard when the certificates are in a pending validation state during custom hostname creation or during certificate renewals.

If your hostname is using another validation method, you will need to update the "method" field in the SSL object to be "txt".

After this step, follow the normal steps for TXT validation.