SSL/TLS features and availability

Refer to the following table to check the availability of all Cloudflare SSL/TLS features.

Feature	Additional features	Free	Pro	Business	Enterprise
Advanced Certificates		Paid add-on	Paid add-on	Paid add-on	Paid add-on
Always Use HTTPS		Yes	Yes	Yes	Yes
Authenticated origin pull		Yes	Yes	Yes	Yes
Automatic HTTPS Rewrites		Yes	Yes	Yes	Yes
Backup Certificates		Yes	Yes	Yes	Yes
	Can opt out?	No	No	No	Yes
Certificate Transparency Monitoring		Yes	Yes	Yes	Yes
	Email Recipients	All account members	All account members	Specified email addresses	Specified email addresses
Certificate Signing Requests		No	No	No	Included with Advanced Certificate Manager
Custom Certificates		No	No	Yes	Yes
	Certificates included	0	0	1 (Modern) 1 (Legacy)	1 (Modern) (can purchase more) 1 (Legacy) (can purchase more)
Custom origin trust store		Included with Advanced Certificate Manager	Included with Advanced Certificate Manager	Included with Advanced Certificate Manager	Included with Advanced Certificate Manager
Delegated DCV		Included with Advanced Certificate Manager	Included with Advanced Certificate Manager	Included with Advanced Certificate Manager	Included with Advanced Certificate Manager
SSL/TLS encryption mode		Yes	Yes	Yes	Yes
	Strict (SSL-Only Origin Pull)	No	No	No	Yes
HTTP Strict Transport Security		Yes	Yes	Yes	Yes
Keyless SSL		No	No	No	Paid add-on
Minimum TLS Version		Yes	Yes	Yes	Yes
Opportunistic Encryption		Yes	Yes	Yes	Yes
Origin certificates		Yes	Yes	Yes	Yes
SSL/TLS Recommender		Yes	Yes	Yes	Yes
Staging environment		No	No	No	Yes (open beta)
TLS 1.3		Yes	Yes	Yes	Yes
Total TLS		Included with Advanced Certificate Manager	Included with Advanced Certificate Manager	Included with Advanced Certificate Manager	Included with Advanced Certificate Manager
Universal Certificates		Yes	Yes	Yes	Yes
Custom Hostnames		Yes	Yes	Yes	Yes
	Hostnames included	100	100	100	0
	Max hostnames	5000	5000	5000	Unlimited, but contact sales if using over 5000.
	CSR support	No	No	No	Yes
	Custom analytics	Yes	Yes	Yes	Yes
	Custom certificates	No	No	No	Yes
	Custom origin	No	No	No	Yes
	mTLS support	No	No	No	Yes
	Non-SNI support for SaaS zone	No	Yes	Yes	Yes
	Selectable CA	No	No	No	Yes
	WAF for SaaS	WAF rules with current zone plan	WAF rules with current zone plan	WAF rules with current zone plan	Create and apply custom firewall rulesets.
	Wildcard custom hostnames	No	No	No	Yes
	Apex proxing/BYOIP	No	No	No	Paid add-on
	Custom metadata	No	No	No	Paid add-on