Reference guide · cloudflare · Published 2026-08-16 · 3 min read
Cloudflare Universal SSL versus a custom certificate
Cloudflare Universal SSL versus custom certificate: who issues each, coverage limits, and when to switch for your origin and brand.
- ·Universal is automatic
- ·When you need custom
- ·The origin side
Universal SSL is the automatic path
Every Cloudflare zone gets a free, automatically-issued SSL certificate covering the site between the visitor and the Cloudflare edge. It is issued for the domain during onboarding, kept renewed, and requires no action from you. That certificate is what powers the "padlock" for most sites on the platform.
The SSL modes article covers how that edge certificate interacts with your origin, and the edge-side certificate itself is the subject here. Universal SSL typically covers the apex and immediate names, sometimes via a shared certificate that broadens to certain delegated names, and its coverage rules are the main reason to consider a custom certificate.
When a custom certificate earns its keep
A custom certificate is one you supply, either a certificate you purchased that you upload, or a certificate generated for your brand through a broader-cover flow such as Advanced Certificate Manager or the SSL for SaaS add-on. You would reach for it when Universal SSL's automatic coverage is not enough:
| Need | Universal SSL | Custom certificate |
|---|---|---|
| Cost | Free, automatic | Uploaded or paid, requires setup |
| Coverage | Common apex and delegated names | You control exactly which names are covered |
| Brand / BYO cert | No | Use your own issued certificate |
| Non-standard names | May not cover every host | Add exactly the names you need |
Real sites most often move to a custom certificate because a subdomain, a regional host, or a wildcard-style set of names is either not covered by Universal SSL's automatic set or needs to match a certificate their own security policy issued. Importing your own cert also lets you keep a single, trusted identity across everything you serve.
The origin side still matters
Whichever edge certificate you choose, the connection from Cloudflare back to your origin is governed by the SSL mode setting, such as Full (strict). A strong edge certificate does not secure a clear-text origin link, so the edge certificate and the origin connection are two separate decisions:
- The edge certificate is what your visitors see and trust.
- The origin connection decides how Cloudflare talks to your server, and Full (strict) validates the origin certificate properly.
An edge certificate on its own does not make the site-wide SSL story complete, and the certificate types context explains the difference between edge and origin trust.
The practical decision
Start with Universal SSL; for the overwhelming majority of zones it covers the site and it is maintained for you. Move to a custom certificate only when you need explicit coverage of names the automatic certificate does not carry, when your security team already issues certificates you should reuse, or when you are serving a set of hosts that must all appear under one trusted identity. Keep the origin validated with Full (strict) in either case, so the edge certificate you chose actually secures the whole connection rather than just the first hop.