Limitations for Universal SSL

Universal SSL certificates are limited by the hostnames they cover and the browsers they support.

​​ Hostname coverage

​​ Full setup

Universal SSL certificates only support SSL for the root or first-level subdomains such as example.com and www.example.com. To enable SSL support on second, third, and fourth-level subdomains such as dev.www.example.com or app3.dev.www.example.com, you can:

• Purchase Advanced Certificate Manager, to cover more than one level of subdomain, remove Cloudflare branding from the Universal certificate, or adjust the shortest certificate lifespan.
• Upgrade to a Business or Enterprise plan to upload a Custom SSL certificate

​​ CNAME setup

On a CNAME setup zone, each subdomain has its own Universal SSL certificate and does not require additional features or purchases.

​​ Browser support

For more on browser support, see Browser compatibility.

​​ Spectrum

Universal SSL is not compatible with Cloudflare Spectrum. If you are trying to use Spectrum, use either an advanced certificate or a custom certificate.

​​ Certificate authority

For Universal SSL certificates, Cloudflare chooses the certificate authority used for your certificate.

If you want to choose the issuing certificate authority, order an advanced certificate.