![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Concepts
- Get started
- Edge certificates
- Overview
- Advanced certificates
- Enforce HTTPS connections
- Domain control validation (DCV)
- Geo Key ManagerBeta
- Add CAA records
- Staging environmentBeta
- Backup certificates
- ECH ProtocolBeta
- Additional options
- Origin server
- Automatic key exchange to origins
- SSL/TLS RecommenderDeprecated
- Cloudflare origin CA
- Authenticated Origin Pulls (mTLS)
- Custom Origin Trust Store
- Cipher suites
- Cloudflare for SaaS
- Keyless SSL
- Reference
- FAQ
- Changelog
- Home
- /SSL/TLS
- /Edge certificates
- /Universal SSL
Universal SSL
By default, Cloudflare issues and renews free, unshared, publicly trusted SSL certificates to all domains added to and activated on Cloudflare.
On a full setup, Universal SSL certificates cover your root domain (for example, example.com) and first-level subdomains (for example, www.example.com). On a partial (CNAME) setup, each proxied subdomain receives its own certificate regardless of depth. Cloudflare handles issuance, renewal, and deployment automatically.
For full setup zones that need coverage beyond first-level subdomains, use Total TLS or advanced certificates.
Universal certificates are Domain Validated (DV), which means the certificate authority verifies domain ownership but does not validate organization identity. For setup details, refer to Enable Universal SSL.
Note
Universal SSL certificates are issued after your domain is active on Cloudflare. If you need an SSL certificate before migrating traffic, or if you need to customize cipher suites, use Advanced or Custom certificates.
| Free | Pro | Business | Enterprise | |
|---|---|---|---|---|
| Availability | Yes | Yes | Yes | Yes |
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}