Certificate Authority Chain Management

4/11/2025

This post introduces a next-generation Certificate Transparency (CT) log design, the static CT API, built on Cloudflare Workers. It details the challenges of operating traditional CT logs (integrity and availability) and proposes the static CT API as a solution. The static CT API organizes log data into cacheable tiles, making it easier to serve from object storage and CDN infrastructure. It also introduces deduplication of issuer certificates. Cloudflare has open-sourced its Rust implementation of this new log design and deployed test logs using this infrastructure.

4/12/2024

Cloudflare is proactively managing the transition away from Let's Encrypt's IdenTrust cross-signed certificate chain to its ISRG Root X1 chain. To ensure continued compatibility for legacy devices (e.g., Android 7.1.1 and older), Cloudflare will migrate certificates up for renewal to a different CA that supports these older systems. Customers will only receive Let's Encrypt certificates if they explicitly request them. This involves modifying the certificate pipeline to handle this CA change without customer intervention, ensuring zero impact on certificate acquisition and supporting a wide range of clients and devices.

3/14/2024

Cloudflare will stop issuing Let's Encrypt certificates from the IdenTrust cross-signed chain on May 15, 2024, and will exclusively use Let's Encrypt's ISRG Root X1 chain for future issuances. This proactive change addresses the upcoming expiration of the IdenTrust chain on September 30, 2024. The post details the potential impact on legacy devices (e.g., Android 7.1.1 and older) and provides data on affected client percentages. It also offers mitigation strategies, including updating trust stores, removing certificate pinning, and utilizing alternative CAs like Google Trust Services for Enterprise clients.

3/23/2023

Introduced DCV Delegation, a feature allowing customers with external DNS providers to delegate Domain Control Validation (DCV) to Cloudflare. This enables automatic renewal of TLS certificates by having customers place a one-time CNAME record pointing to a Cloudflare-managed domain, which then handles the necessary TXT DNS records for DCV. This addresses challenges for 'partial' zones and SSL for SaaS custom hostnames, simplifying certificate lifecycle management and improving security posture.

3/14/2022

Introduced 'backup certificates' to enhance resilience against mass certificate re-issuance events. These backup certificates are issued from a different Certificate Authority (CA) and wrapped with a different private key than the primary certificate. This strategy mitigates risks associated with key compromises and mass revocations by CAs. The deployment plan includes issuing backup certificates for Universal Certificate orders for Free, Pro, and Biz accounts, followed by Enterprise customers. Future plans include extending this to Advanced Certificates, SSL for SaaS, and customer-uploaded certificates, aiming for instantaneous deployment.

10/6/2021

Introduced a staging environment for custom uploaded TLS certificates for Enterprise customers. This feature allows users to test new certificates against a pair of staging IPs before pushing them to production, mitigating risks associated with certificate pinning and ensuring successful TLS termination. The staging environment replicates the production environment but is only accessible via specific staging IPs. Users can upload certificates, make curl requests to verify coverage and correctness, and then push to production or disable if issues arise. Future plans include staging certificate renewals and TLS configuration changes.

3/27/2021

This post revisits the Heartbleed vulnerability and details Cloudflare's subsequent advancements in TLS/SSL security. Key contributions include the development and promotion of Keyless SSL, Geo Key Manager, Keyless Everywhere, and Delegated Credentials for enhanced private key protection. It also highlights improvements in certificate revocation mechanisms, specifically the adoption and support of OCSP Must-staple, to address the shortcomings exposed by the Heartbleed event.

3/27/2021

Introduced Advanced Certificate Manager (ACM) as an upgrade to Dedicated Certificates. ACM provides flexible and customizable certificate management, including setting custom validity periods as short as 14 days, granular control over TLS cipher suites, and the ability to generate Certificate Signing Requests (CSRs) for external CA integration. ACM supports up to 100 edge certificates per zone, multi-level hostname support, and choice of validation methods (HTTP, TXT, Email) and Certificate Authorities (Let's Encrypt, Digicert). Existing Dedicated Certificate customers will be migrated to ACM with zero downtime.

11/13/2020

This post introduces `origin-ca-issuer`, a Kubernetes extension for cert-manager that integrates with Cloudflare's Origin CA. It details how to create an `OriginIssuer` resource to bind cert-manager to the Cloudflare API and how to create a `Certificate` resource to define domain names, duration, and renewal policies. The post also explains how to leverage Ingress support for automatic certificate management. It further elaborates on the internal architecture of the `origin-ca-issuer`, describing the roles of the `OriginIssuer` controller and the `CertificateRequest` controller in managing the certificate lifecycle.

8/9/2019

This post introduces Certificate Transparency Monitoring, a new feature that allows customers to receive email alerts when a certificate is issued for their domains. This is achieved by crawling public Certificate Transparency logs and checking against a list of monitored domains. The feature leverages existing infrastructure like Merkle Town and 'The Crawler' for efficient processing. It also details how to enable the feature in the dashboard and the process for handling suspicious certificate alerts, including contacting the Certificate Authority (CA) for revocation.

1/23/2019

This post details the technical process of using Cloudflare's Certificate Transparency monitor (Merkle Town) to identify expiring federal .gov certificates. It describes the use of HBase and MapReduce for scanning over a billion certificates, filtering for .gov domains expiring within two months, and a subsequent pass to validate if the certificates are actually being served. It also highlights the discovery of misconfigured TLS certificates and incomplete certificate chains on .gov websites.

3/24/2018

This post introduces Merkle Town, Cloudflare's dashboard for monitoring Certificate Transparency (CT) logs. It details the dashboard's features, including log monitoring methodology (fetching STH and roots, crawling new entries, submitting certificates), uptime and response time calculations, and certificate breakdown by type (validation level, public key algorithm, signature algorithm, entry type, expired vs. current). It also highlights observations on root certificate authorities, global issuance rates (attributing ~75% to Let's Encrypt), legacy algorithms, and CA interdependencies for obtaining Signed Certificate Timestamps (SCTs). The post emphasizes the importance of CT logs for browser trust and encourages organizations to become log operators.

3/23/2018

This post introduces Cloudflare's support for Certificate Transparency (CT) by launching Nimbus, a public CT log, and Merkle Town, a dashboard for exploring the CT ecosystem. It explains the importance of CT for improving online security and accountability in the web PKI, detailing the roles of log operators, auditors, and monitors, and how browsers require SCTs from vetted logs for CT qualification.

3/12/2018

This post announces the deprecation of TLS 1.0 and 1.1 on api.cloudflare.com and the Cloudflare dashboard, mandating TLS 1.2 or higher for API calls and dashboard access. It outlines the timeline for these changes, including warning messages in API responses, a 24-hour brownout period, and permanent disabling of older TLS versions. The post also details upcoming controls and analytics features, such as the 'Minimum TLS Version' setting and TLS version usage analytics, to help customers manage their own TLS configurations.

12/7/2017

This post announces the removal of the beta flag for Certification Authority Authorization (CAA) record support, making it available to all Cloudflare users. It details the purpose of CAA records in preventing certificate mis-issuance, explains the RFC6844 specification for CAA properties (`issue`, `issuewild`, `iodef`), and highlights a critical processing algorithm flaw related to CNAME records and the traversal of the DNS tree. Cloudflare also details its implementation, including automatic augmentation of CAA records for Universal SSL customers.

2/24/2015

Introduced a new Origin CA service that provides free, limited-function certificates for customer origin servers. This enables end-to-end encryption from the browser to the origin, eliminating the need for customers to purchase third-party certificates for this purpose. The service uses Cloudflare's open-source CFSSL toolkit for certificate issuance and validation. The post also provides instructions on how to create Certificate Signing Requests (CSRs) using CFSSL.

11/11/2014

This post details Cloudflare's proactive response to upcoming browser policy changes regarding SHA-1 certificates. It explains the technical implications of SHA-1 deprecation by Chrome and Firefox, the compatibility challenges with older operating systems like Windows XP SP2, and Cloudflare's strategy to address these by reissuing SHA-1 certificates expiring before 2016 for paid customers and using SHA-2 by default for free customers. It also outlines future plans to offer SNI certificates with SHA-2 as primary for paid customers, with SHA-1 as a fallback.

4/17/2014

This post details the significant technical and economic costs associated with mass SSL certificate revocation, specifically in the context of the Heartbleed vulnerability. It explains the mechanisms of OCSP and CRL, highlights the bandwidth and infrastructure burden they place on Certificate Authorities (CAs), and quantifies the potential monthly bandwidth costs for a CA like Globalsign. Cloudflare's role in supporting Globalsign's OCSP and CRL infrastructure is also mentioned as a way to mitigate these costs and enable faster revocation processes.

9/8/2011

This post details an incident where allegations of a compromise at GlobalSign, a CA partner, temporarily suspended new SSL certificate issuance. It explains the role of CAs in establishing trust for SSL certificates, the risks associated with compromised CAs (impersonation and traffic interception), and Cloudflare's response, including the ability to automatically reissue and deploy new certificates across its network to maintain service integrity.