SSL/TLS

Manage SSL/TLS certificates and settings for your zones

The SSL resource provides methods to manage SSL/TLS certificates, certificate packs, verification, and recommendations for your Cloudflare zones.

Certificate packs

create

Order a new certificate pack.

const certificatePack = await client.ssl.certificatePacks.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  type: 'advanced',
  hosts: ['example.com', '*.example.com'],
  validation_method: 'txt',
  validity_days: 90,
  certificate_authority: 'lets_encrypt'
});

zone_id · string · required

Zone identifier

type · 'advanced' · required

Certificate pack type

hosts · string[] · required

Comma-separated list of hostnames (e.g., [‘example.com’, ‘*.example.com’])

validation_method · 'txt' | 'http' | 'email' · required

Validation method for the certificate

validity_days · number · required

Certificate validity period (14, 30, 90, or 365 days)

certificate_authority · 'digicert' | 'google' | 'lets_encrypt' · required

Certificate authority to use

id · string

Certificate pack identifier

type · string

Certificate pack type

hosts · string[]

List of hostnames covered by the certificate

status · string

Certificate status (e.g., ‘initializing’, ‘pending_validation’, ‘active’)

validation_method · string

Validation method used

validity_days · number

Certificate validity period in days

list

List all certificate packs for a zone.

for await (const pack of client.ssl.certificatePacks.list({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353'
})) {
  console.log(`${pack.id}: ${pack.status}`);
}

zone_id · string · required

Zone identifier

status · string

Filter by certificate status

delete

Delete a certificate pack.

const result = await client.ssl.certificatePacks.delete(
  'advanced_cert_123',
  { zone_id: '023e105f4ecef8ad9ca31a8372d0c353' }
);

certificate_pack_id · string · required

Certificate pack identifier (first parameter)

zone_id · string · required

Zone identifier

get

Get details for a specific certificate pack.

const pack = await client.ssl.certificatePacks.get(
  'advanced_cert_123',
  { zone_id: '023e105f4ecef8ad9ca31a8372d0c353' }
);

certificate_pack_id · string · required

Certificate pack identifier (first parameter)

zone_id · string · required

Zone identifier

SSL verification

get

Get SSL verification status for all certificate packs.

const verification = await client.ssl.verification.get({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353'
});

zone_id · string · required

Zone identifier

edit

Edit SSL verification method for a certificate pack.

const result = await client.ssl.verification.edit(
  'advanced_cert_123',
  {
    zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
    validation_method: 'http'
  }
);

certificate_pack_id · string · required

Certificate pack identifier (first parameter)

zone_id · string · required

Zone identifier

validation_method · 'txt' | 'http' | 'email' · required

New validation method

SSL recommendations

get

Get SSL/TLS recommendations for a zone.

const recommendation = await client.ssl.recommendations.get({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353'
});

zone_id · string · required

Zone identifier

id · string

Recommendation identifier

enabled · boolean

Whether SSL/TLS recommendation is enabled

Universal SSL

settings.get

Get Universal SSL settings for a zone.

const settings = await client.ssl.universal.settings.get({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353'
});

settings.edit

Edit Universal SSL settings.

const settings = await client.ssl.universal.settings.edit({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  enabled: true
});

zone_id · string · required

Zone identifier

enabled · boolean · required

Whether to enable Universal SSL

SSL analysis

create

Analyze SSL/TLS configuration for a hostname.

const analysis = await client.ssl.analyze.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  host: 'example.com'
});

zone_id · string · required

Zone identifier

host · string · required

Hostname to analyze

Validation methods

Cloudflare supports three validation methods for SSL certificates:

• txt - DNS TXT record validation (most common)
• http - HTTP file validation
• email - Email validation to domain contacts

Certificate authorities

Cloudflare supports the following certificate authorities:

• lets_encrypt - Let’s Encrypt (free, automated)
• google - Google Trust Services
• digicert - DigiCert (Enterprise only)

Example usage

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env.CLOUDFLARE_API_TOKEN
});

const zoneId = '023e105f4ecef8ad9ca31a8372d0c353';

// Order a new advanced certificate
const cert = await client.ssl.certificatePacks.create({
  zone_id: zoneId,
  type: 'advanced',
  hosts: ['example.com', '*.example.com', 'www.example.com'],
  validation_method: 'txt',
  validity_days: 90,
  certificate_authority: 'lets_encrypt'
});

console.log('Certificate ordered:', cert.id);
console.log('Status:', cert.status);

// Check verification status
const verification = await client.ssl.verification.get({
  zone_id: zoneId
});

console.log('Verification records:', verification);

// List all certificates
for await (const pack of client.ssl.certificatePacks.list({
  zone_id: zoneId
})) {
  console.log(`Certificate ${pack.id}:`);
  console.log(`  Hosts: ${pack.hosts.join(', ')}`);
  console.log(`  Status: ${pack.status}`);
  console.log(`  Valid for: ${pack.validity_days} days`);
}

// Get SSL recommendations
const recommendation = await client.ssl.recommendations.get({
  zone_id: zoneId
});

console.log('SSL Recommendation enabled:', recommendation.enabled);

// Enable Universal SSL
await client.ssl.universal.settings.edit({
  zone_id: zoneId,
  enabled: true
});

// Analyze SSL configuration
const analysis = await client.ssl.analyze.create({
  zone_id: zoneId,
  host: 'example.com'
});

console.log('SSL Analysis:', analysis);