Certificate Authority

September 4, 2025

Addressing the unauthorized issuance of multiple TLS certificates for 1.1.1.1

Unauthorized TLS certificates were issued for 1.1.1.1 by a Certification Authority without permission from Cloudflare. These rogue certificates have now been revoked.

September 19, 2024

How Cloudflare is helping domain owners with the upcoming Entrust CA distrust by Chrome and Mozilla

Chrome and Mozilla will stop trusting Entrusts public TLS certificates issued after November 2024 due to concerns about Entrusts compliance with security standards. In response, Entrust is partnering with SSL.com to continue providing trusted certificates. Cloudflare will support SSL.com as a CA, simplifying certificate management for customers using Entrust by automating issuance and renewals.

April 12, 2024

How we ensure Cloudflare customers aren't affected by Let's Encrypt's certificate chain change

Lets Encrypts cross-signed chain will be expiring in September. This will affect legacy devices with outdated trust stores (Android versions 7.1.1 or older). To prevent this change from impacting customers, Cloudflare will shift Lets Encrypt certificates upon renewal to use a different CA

March 24, 2018

A tour through Merkle Town, Cloudflare's Certificate Transparency dashboard

The success of Certificate Transparency rests on the existence of a robust ecosystem of logs and log operators.

March 23, 2018

Introducing Certificate Transparency and Nimbus

Certificate Transparency (CT) is an ambitious project to help improve security online by bringing accountability to the system that protects HTTPS.

December 7, 2017

CAA of the Wild: Supporting a New Standard

One thing we take pride in at Cloudflare is embracing new protocols and standards that help make the Internet faster and safer. Sometimes this means that well launch support for experimental features or standards still under active development, as we did with TLS 1.3.

July 6, 2017

How to make your site HTTPS-only

The Internet is getting more secure every day as people enable HTTPS, the secure version of HTTP, on their sites and services.

May 10, 2016

How we built Origin CA: Web Crypto

At CloudFlare we strive to combine features that are simple, secure, and backed by solid technology. The Origin CA is a great example of this. You no longer need to go to a third-party certificate authority to protect the connection between CloudFlare and your origin server.

December 22, 2015

Why its harder to forge a SHA-1 certificate than it is to find a SHA-1 collision

Its well known that SHA-1 is no longer considered a secure cryptographic hash function. Researchers now believe that finding a hash collision (two values that result in the same value when SHA-1 is applied) is inevitable and likely to happen.

June 24, 2015

How to build your own public key infrastructure

A major part of securing a network as geographically diverse as CloudFlares is protecting data as it travels between datacenters. Customer data and logs are important to protect but so is all the control data that our applications use to communicate with each other.

February 24, 2015

Universal SSL: Encryption all the way to the origin, for free

Last September, CloudFlare unveiled Universal SSL, enabling HTTPS support for all sites by default. All sites using CloudFlare now support strong cryptography from the browser to CloudFlares servers.