Universal SSL
By default, Cloudflare issues — and renews — free, unshared, publicly trusted SSL certificates to all domains added to and activated on Cloudflare.
On a full setup, Universal SSL certificates cover your root domain (for example, example.com) and first-level subdomains (for example, www.example.com). On a partial (CNAME) setup, each proxied subdomain receives its own certificate regardless of depth. Cloudflare handles issuance, renewal, and deployment automatically.
For full setup zones that need coverage beyond first-level subdomains, use Total TLS or advanced certificates.
Universal certificates are Domain Validated (DV), which means the certificate authority verifies domain ownership but does not validate organization identity. For setup details, refer to Enable Universal SSL.
| Free | Pro | Business | Enterprise | |
|---|---|---|---|---|
Availability | Yes | Yes | Yes | Yes |