Enjoy the security risks

sachin gupta•2/18/25, 1:44 PM

I have a custom wildcard SSL certificate , and I want to apply it only to abc.xyz.com while keeping all other subdomains under Cloudflare Universal SSL.

can any one help me on this

Ssachin gupta I have a custom wildcard SSL certificate , and I want to apply it only to abc.xy...

Laudian•2/18/25, 2:00 PM

I don't believe that's possible with a single zone.

Laudian•2/18/25, 2:01 PM

https://developers.cloudflare.com/ssl/reference/certificate-and-hostname-priority/

LLaudian I don't believe that's possible with a single zone.

Hard@Work•2/18/25, 2:01 PM

Isn't that just an ACM cert, tied to the

abc

abc

subdomain?

HHard@Work Isn't that just an ACM cert, tied to the `abc` subdomain?

Laudian•2/18/25, 2:02 PM

From what I understand, he doesn't want to use ACM but a self-uploaded custom certificate.

LLaudian From what I understand, he doesn't want to use ACM but a self-uploaded custom ce...

Hard@Work•2/18/25, 2:03 PM

Like this? https://developers.cloudflare.com/ssl/edge-certificates/custom-certificates/

Cloudflare Docs

Custom certificates · Cloudflare SSL/TLS docs

Custom certificates are meant for Business and Enterprise customers who want to use their own SSL certificates.

HHard@Work Like this? https://developers.cloudflare.com/ssl/edge-certificates/custom-certif...

Laudian•2/18/25, 2:04 PM

That's what I understand.

LLaudian That's what I understand.

Hard@Work•2/18/25, 2:04 PM

I'm not sure I understand, this should work as they want, no?

Erisa•2/18/25, 2:04 PM

they want a wildcard cert only on one subdomain, you cant do that
as soon as you upload the wildcard it will be in use for all subdomains

EErisa they want a wildcard cert only on one subdomain, you cant do that as soon as you...

Hard@Work•2/18/25, 2:05 PM

Wait, can you not just tell it, nuh uh, this isn't a wildcard cert, use it only for this one sub?

Hard@Work•2/18/25, 2:06 PM

Or well, actually, did they mean wildcard on

abc.xyz.com

abc.xyz.com

, like

*.abc.xyz.com

*.abc.xyz.com

HHard@Work Wait, can you not just tell it, nuh uh, this isn't a wildcard cert, use it only ...

Erisa•2/18/25, 2:06 PM

no, the hostnames for a cert are inside the cert, you cant override them

Hello, I’m Allie!•2/18/25, 2:07 PM

Oop

Hello, I’m Allie!•2/18/25, 2:07 PM

Well til

Laudian•2/18/25, 2:09 PM

I guess you could set the subdomain up as a partial zone, but probably not worth it buying a second Business plan for that.

MMattIPv4 Wonderful. Don’t expect sites to support old, dangerous versions then.

dave•2/18/25, 2:11 PM

Chrome 59 is the safest version historically to run, I've never seen an exploit for it.

https://googleprojectzero.blogspot.com/2021/01/in-wild-series-chrome-exploits.html

EErisa they want a wildcard cert only on one subdomain, you cant do that as soon as you...

sachin gupta•2/18/25, 2:11 PM

how i achieve this only apply to abc.xyz.com not other domains because the certificate is wildcard and i have to upload on custom

Ssachin gupta how i achieve this only apply to abc.xyz.com not other domains because the certi...

Hard@Work•2/18/25, 2:11 PM

You can't

Ssachin gupta how i achieve this only apply to abc.xyz.com not other domains because the certi...

Laudian•2/18/25, 2:12 PM

Can you explain why you need a custom certificate for that specific subdomain but not for the rest of your zone?

LLaudian I guess you could set the subdomain up as a partial zone, but probably not worth...

Erisa•2/18/25, 2:13 PM

you cant create subdomain zones with just business plan, and creating a second zone as partial for the same domain doesnt work because a domain can only be on one zone at once regardless of type
you need enterprise to create the subdomain zone for this

sachin gupta•2/18/25, 2:13 PM

becasue i want to used cloudflare certificate

sachin gupta•2/18/25, 2:13 PM

i have enterprise plan

Erisa•2/18/25, 2:14 PM

then create a subdomain zone

MattIPv4•2/18/25, 2:14 PM

:This: If you have ENT, create a subdomain zone and then add the cert in that zone, so it'll be scoped to just that zone/subdomain

Erisa•2/18/25, 2:14 PM

https://developers.cloudflare.com/dns/zone-setups/subdomain-setup/

Cloudflare Docs

Subdomain setup · Cloudflare DNS docs

When you use a subdomain setup, you can manage the Cloudflare configurations for one or more subdomains separately from those associated with your apex domain. This means that, on your account homepage, you would find websites like example.com or blog.example.com listed as separate zones.

EErisa you cant create subdomain zones with just business plan, and creating a second z...

Laudian•2/18/25, 2:15 PM

Oh, I forgot that partial zones still can't be subdomains.

Erisa•2/18/25, 2:18 PM

if all is well and total tls is working as designed, no
but if a total tls cert fails to issue, fails to renew or otherwise goes missing / isnt ready yet, universal is used as a backup

Original message was deleted

Laudian•2/18/25, 2:18 PM

It gets used if you manually delete a hostname from Total TLS or exceed the number of certificates that are available on ACM.

LLaudian It gets used if you manually delete a hostname from Total TLS or exceed the numb...

Erisa•2/18/25, 2:19 PM

total tls certs dont count towards the limit of advanced certs

Original message was deleted

Erisa•2/18/25, 2:19 PM

no, universal will always use whatever was randomly selected for your zone, no matter what you pick for total tls

EErisa total tls certs dont count towards the limit of advanced certs

Laudian•2/18/25, 2:19 PM

Well, let me join the til club.

Erisa•2/18/25, 2:20 PM

sometimes, but usually only when they deprecate CAs

Erisa•2/18/25, 2:20 PM

e.g. if you had digicert before, now youll have a different one

Erisa•2/18/25, 2:21 PM

if you want to guarentee the CA is always the same, issue a manual advanced cert for example.com and *.example.com, disable universal and use the manually issued one as the fallback instead

WWTDawson9 Enjoy the security risks

Edu Pintilie•2/18/25, 2:21 PM

Enjoy the lag

Erisa•2/18/25, 2:22 PM

yea

MMattIPv4 I can't imagine they're going to revert, most websites build themselves in a way...

Edu Pintilie•2/18/25, 2:22 PM

What is polyfill?

Erisa•2/18/25, 2:22 PM

disabling universal and using only advanced is good if you want control over your certs and their CAs

EEdu Pintilie What is polyfill?

MattIPv4•2/18/25, 2:23 PM

Extra code that you ship to the browser to recreate modern features in older browsers

EEdu Pintilie Enjoy the lag 👍🏻

WTDawson9OP•2/18/25, 2:23 PM

100 tabs and no lag

WWTDawson9 100 tabs and no lag 👍

Edu Pintilie•2/18/25, 2:24 PM

I have 1200 tabs on chrome 88 (mobile) and still it's pretty useable

Edu Pintilie•2/18/25, 2:24 PM

With 100 it flies

Original message was deleted

Erisa•2/18/25, 2:24 PM

yeah pin it to the google CA, disable universal and only issue advanced google certs

Edu Pintilie•2/18/25, 2:24 PM

Try opening 1200 tabs (not empty)

MattIPv4•2/18/25, 2:26 PM

I have never once wanted my browser to have 1,200 tabs open

MattIPv4•2/18/25, 2:27 PM

I have frequently wanted my browser to not have RCEs

MattIPv4•2/18/25, 2:27 PM

Each to their own though :nod: But this argument about Cf supporting older browsers isn't going anywhere

MMattIPv4 Each to their own though :nod: But this argument about Cf supporting older brows...

Edu Pintilie•2/18/25, 2:28 PM

Original message was deleted

Laudian•2/18/25, 2:28 PM

You can't multitask 1200 things at once? Pathetic.

Erisa•2/18/25, 2:29 PM

Look, you can use whatever browser you want. But arguing or continuing to discuss it at length here isn't productive and it would be great if we could move on from that

Enjoy the security risks

Similar Threads

Similar Threads

Similar Threads