I can't imagine they're going to revert, most websites build themselves in a way where they support

I can't imagine they're going to revert, most websites build themselves in a way where they support a certain number of versions back for a browser, or do it based on usage %. It allows them to use modern features instead of being stuck in the past (or trying to polyfill everything) forever.

EEdu Pintilie And don't expect for me to use this in my websites, I want my websites useable a...

WTDawson9•2/18/25, 1:36 PM

Enjoy the security risks

sachin gupta•2/18/25, 1:44 PM

I have a custom wildcard SSL certificate , and I want to apply it only to abc.xyz.com while keeping all other subdomains under Cloudflare Universal SSL.

can any one help me on this

Ssachin gupta I have a custom wildcard SSL certificate , and I want to apply it only to abc.xy...

Laudian•2/18/25, 2:00 PM

I don't believe that's possible with a single zone.

Laudian•2/18/25, 2:01 PM

https://developers.cloudflare.com/ssl/reference/certificate-and-hostname-priority/

LLaudian I don't believe that's possible with a single zone.

Hard@Work•2/18/25, 2:01 PM

Isn't that just an ACM cert, tied to the abcabc subdomain?

HHard@Work Isn't that just an ACM cert, tied to the `abc` subdomain?

Laudian•2/18/25, 2:02 PM

From what I understand, he doesn't want to use ACM but a self-uploaded custom certificate.

LLaudian From what I understand, he doesn't want to use ACM but a self-uploaded custom ce...

Hard@Work•2/18/25, 2:03 PM

Like this? https://developers.cloudflare.com/ssl/edge-certificates/custom-certificates/

Cloudflare Docs

Custom certificates · Cloudflare SSL/TLS docs

Custom certificates are meant for Business and Enterprise customers who want to use their own SSL certificates.

HHard@Work Like this? https://developers.cloudflare.com/ssl/edge-certificates/custom-certif...

Laudian•2/18/25, 2:04 PM

That's what I understand.

LLaudian That's what I understand.

Hard@Work•2/18/25, 2:04 PM

I'm not sure I understand, this should work as they want, no?

Erisa•2/18/25, 2:04 PM

they want a wildcard cert only on one subdomain, you cant do that
as soon as you upload the wildcard it will be in use for all subdomains

EErisa they want a wildcard cert only on one subdomain, you cant do that as soon as you...

Hard@Work•2/18/25, 2:05 PM

Wait, can you not just tell it, nuh uh, this isn't a wildcard cert, use it only for this one sub?

Hard@Work•2/18/25, 2:06 PM

Or well, actually, did they mean wildcard on abc.xyz.comabc.xyz.com, like *.abc.xyz.com*.abc.xyz.com?

HHard@Work Wait, can you not just tell it, nuh uh, this isn't a wildcard cert, use it only ...

Erisa•2/18/25, 2:06 PM

no, the hostnames for a cert are inside the cert, you cant override them

Hello, I’m Allie!•2/18/25, 2:07 PM

Oop

Hello, I’m Allie!•2/18/25, 2:07 PM

Well til

Laudian•2/18/25, 2:09 PM

I guess you could set the subdomain up as a partial zone, but probably not worth it buying a second Business plan for that.

MMattIPv4 Wonderful. Don’t expect sites to support old, dangerous versions then.

dave•2/18/25, 2:11 PM

Chrome 59 is the safest version historically to run, I've never seen an exploit for it.

https://googleprojectzero.blogspot.com/2021/01/in-wild-series-chrome-exploits.html

EErisa they want a wildcard cert only on one subdomain, you cant do that as soon as you...

sachin gupta•2/18/25, 2:11 PM

how i achieve this only apply to abc.xyz.com not other domains because the certificate is wildcard and i have to upload on custom

Ssachin gupta how i achieve this only apply to abc.xyz.com not other domains because the certi...

Hard@Work•2/18/25, 2:11 PM

You can't

Ssachin gupta how i achieve this only apply to abc.xyz.com not other domains because the certi...

Laudian•2/18/25, 2:12 PM

Can you explain why you need a custom certificate for that specific subdomain but not for the rest of your zone?

LLaudian I guess you could set the subdomain up as a partial zone, but probably not worth...

Erisa•2/18/25, 2:13 PM

you cant create subdomain zones with just business plan, and creating a second zone as partial for the same domain doesnt work because a domain can only be on one zone at once regardless of type
you need enterprise to create the subdomain zone for this

sachin gupta•2/18/25, 2:13 PM

becasue i want to used cloudflare certificate

sachin gupta•2/18/25, 2:13 PM

i have enterprise plan

Erisa•2/18/25, 2:14 PM

then create a subdomain zone

MattIPv4OP•2/18/25, 2:14 PM

:This: If you have ENT, create a subdomain zone and then add the cert in that zone, so it'll be scoped to just that zone/subdomain

Erisa•2/18/25, 2:14 PM

https://developers.cloudflare.com/dns/zone-setups/subdomain-setup/

Cloudflare Docs

Subdomain setup · Cloudflare DNS docs

When you use a subdomain setup, you can manage the Cloudflare configurations for one or more subdomains separately from those associated with your apex domain. This means that, on your account homepage, you would find websites like example.com or blog.example.com listed as separate zones.

EErisa you cant create subdomain zones with just business plan, and creating a second z...

Laudian•2/18/25, 2:15 PM

Oh, I forgot that partial zones still can't be subdomains.

Erisa•2/18/25, 2:18 PM

if all is well and total tls is working as designed, no
but if a total tls cert fails to issue, fails to renew or otherwise goes missing / isnt ready yet, universal is used as a backup

Original message was deleted

Laudian•2/18/25, 2:18 PM

It gets used if you manually delete a hostname from Total TLS or exceed the number of certificates that are available on ACM.

LLaudian It gets used if you manually delete a hostname from Total TLS or exceed the numb...

Erisa•2/18/25, 2:19 PM

total tls certs dont count towards the limit of advanced certs

Original message was deleted

Erisa•2/18/25, 2:19 PM

no, universal will always use whatever was randomly selected for your zone, no matter what you pick for total tls

EErisa total tls certs dont count towards the limit of advanced certs

Laudian•2/18/25, 2:19 PM

Well, let me join the til club.

Erisa•2/18/25, 2:20 PM

sometimes, but usually only when they deprecate CAs

Erisa•2/18/25, 2:20 PM

e.g. if you had digicert before, now youll have a different one

Erisa•2/18/25, 2:21 PM

if you want to guarentee the CA is always the same, issue a manual advanced cert for example.com and *.example.com, disable universal and use the manually issued one as the fallback instead