Learn to add and edit Custom SSL certificates as well as remove passwords on private key files.
Overview
Custom SSL certificates provide several benefits:
- They are not shared by multiple customer domains.
- Customers can serve valid, existing origin SSL certificates from Cloudflare's network.
Domains on Business and Enterprise plans are allowed Custom SSL certificates once the domains are active on Cloudflare. Only one Custom SSL certificate is allowed per Business domain. By default, Enterprise customers are allowed one Custom SSL certificate per Enterprise domain but can request additional Custom SSL certificates from their Cloudflare Account Team.
Cloudflare allows uploading several SSL certificate types:
- Unified Communications Certificates (UCC)
- Extended Validation (EV)
- Organization Validated (OV)
Before uploading a Custom SSL certificate to Cloudflare, ensure the private key file is not password protected.
Prerequisite: remove the key file password
If an uploaded key file is password protected, the Cloudflare Crypto app generates the following error:
The key is password protected. Please strip the password and re-submit.
To remove a key file password, the solution depends on the Operating System used. For example, if mydomain.com.key is the private key file, the password protection can be removed via one of the following methods:
1. Open a command console.
2. Navigate to the directory containing the mydomain.com.key file.
3. Copy the original key:
cp mydomain.com.key temp.key
4. Run the following command:
openssl rsa -in temp.key -out mydomain.com.key
5. When prompted in the console window, enter the original key password.
6. Upload the contents of the mydomain.com.key file to Cloudflare.
1. Browse to http://indy.fulgan.com/SSL/.
2. Download the latest version of OpenSSL for your x86 or x86_64 Operating System.
3. Open the .zip file and extract it.
4. Click openssl.exe.
5. In the command window that appears, run:
rsa -in C:\Path\To\mydomain.com.key -out key.pem
6. Enter the original key password when prompted by the openssl.exe command window.
7. Upload the contents of the key.pem file, not the mydomain.com.key to Cloudflare.
Upload a Custom SSL certificate
Perform the following steps to upload a Custom SSL certificate:
1. Log in to the Cloudflare dashboard.
2. Click the appropriate Cloudflare account and select the appropriate domain.
3. Click the Crypto app.
4. Click Upload Custom SSL Certificate within the Edge Certificates section. The Upload custom SSL certificate and key window appears.
5. Open the SSL certificate file.
6. Copy and paste the SSL certificate file contents into the SSL Certificate text area.
7. Choose the appropriate Bundle Method (see instructions below).
8. Open the SSL certificate private key file.
9. Copy and paste the private key file contents into the Private key text area.
10. Choose the Geo Key Manager (see instructions below).
The instructions to update a Custom SSL certificate are very similar to the process for originally uploading the certificate.
Choose the Bundle Method
Bundle Method determines how the SSL certificate is bundled with intermediary certificates to complete the certificate chain. The Bundle Method allows customers to choose their preferred SSL certificate chain:
- Compatible allows the greatest compatibility with older browsers and clients.
- Modern optimizes the certificate chain for efficiency by using newer and fewer intermediary certificates that neglect some older browsers.
- User Defined allows customers to provide their own certificate chain.
Choose the Geo Key Manager private key restrictions
Geo Key Manager limits which Cloudflare data centers store the SSL private key. Visit the Cloudflare blog post introducing the Geo Key Manager to learn more about each setting.
Update a Custom SSL certificate
Every SSL certificate has an expiration date. Custom SSL certificates are not automatically renewed by Cloudflare. Therefore, you should monitor your Custom SSL expiration dates and acquire updated SSL certificates from the certificate vendor.
Update a previously uploaded Custom SSL certificate via the following steps:
1. Log in to the Cloudflare dashboard.
2. Click the appropriate Cloudflare account for the domain and select the proper domain.
3. Click the Crypto app.
4. Under Edge Certificates, click Manage for the Custom SSL certificate where Type is Uploaded.
5. Click on the wrench icon and the Replace SSL certificate and key window appears.
6. Follow the original instructions starting in step 5 within the Upload a Custom SSL certificate section of this guide.