Always issue Universal SSL

I added a new domain to Cloudflare and I turned off Universal SSL in the first place, but I queried on crt.sh and found that Cloudflare was still getting a Google Trust Services certificate.

I set the options before modifying the NS server, so there is no doubt that Cloudflare did not follow the relevant configuration.

Or when adding a domain, Cloudflare already has a certificate order ready for the domain, and sends the order as soon as the NS transfer goes through. If so, I would like to be able to turn off the Universal SSL option during the initialization phase.

Do you have Signed Exchanges enabled for this domain?

If so, the certificate will be issued for that.

No, this domain uses the free plan. This issue has come up a few times, and the previous domain was issued with a Cloudflare Inc ECC CA-3 certificate.

Ah, so in that case it may be AMP Real URL:

So this certificate is specifically for AMP Real URL?
OK, thanks for your help.

It would be helpful if information about this could be displayed on the Universal SSL help page.

Correct - thanks for the feedback. I’ve suggested a clarification to the documentation:

2 Likes

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.