Description
Ensure Universal SSL is enabled for the zone, so that Cloudflare automatically issues and renews free edge certificates for the domain and its first-level subdomains. This allows visitors to connect to the site over HTTPS.
Rationale
Without an edge certificate, visitors cannot connect to proxied hostnames over HTTPS, and traffic between visitors and Cloudflare may not be encrypted. Universal SSL gives every proxied zone a valid certificate that renews automatically, removing the risk of expired certificates.
Impact
Visitors can connect over HTTPS
Certificates are issued and renewed automatically
Disabling it without another certificate breaks HTTPS for the zone
Default Value
By default, Universal SSL is enabled for all zones.
Pre-Requisites
Cloudflare account with Administrator or SSL/TLS permissions for the zone
Test Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to SSL/TLS > Edge Certificates.
Find Disable Universal SSL. If the button shows Disable Universal SSL, Universal SSL is enabled; if it shows Enable Universal SSL, it is disabled.
Verify that a Universal certificate is listed with the status Active.
If Universal SSL is disabled, follow the implementation steps.
Implementation Steps
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to SSL/TLS > Edge Certificates.
For Disable Universal SSL, select Enable Universal SSL.
Wait for the Universal certificate status to change to Active.
Backout Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to SSL/TLS > Edge Certificates.
Make sure another certificate (such as an Advanced or custom certificate) covers the hostnames.
For Disable Universal SSL, select Disable Universal SSL, read the warnings, select I Understand, and select Confirm.
Reference