--- description: Review the limitations of Universal certificates, such as hostname coverage, certificate authority choice, and compatibility with other products. title: Limitations image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/ssl/llms.txt > Use this file to discover all available pages before exploring further. # Limitations Last updated Aug 24, 2026|Copy as Markdown|[View as Markdown](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/universal-ssl/limitations/index.md)|[Agent setup](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/agent-setup/) Universal SSL certificates present some limitations. ## Proxy status Cloudflare can only serve an SSL/TLS certificate for a DNS record when you set the record's [proxy status](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/dns/proxy-status/) to **Proxied**. If you do not do this, the origin server your record points to will be responsible for supporting SSL/TLS connections. ## Hostname coverage ### Full setup When you rely only on Universal SSL in a full setup zone, coverage is limited to the root domain (for example, `example.com`) and first-level subdomains (for example, `www.example.com` or `blog.example.com`). Deeper subdomains โ€” such as `dev.www.example.com` or `app3.dev.www.example.com` โ€” are **not** covered and will not serve a valid certificate. To enable SSL for deeper subdomains, you can: * Purchase [Advanced Certificate Manager](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/) โ€” then turn on [Total TLS](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/) for automatic certificate coverage of all proxied subdomains, or manually create advanced certificates for specific hostnames. * Upload a [custom SSL certificate](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/custom-certificates/) that includes the required subdomains as Subject Alternative Names (SANs). ### CNAME setup On a [CNAME setup zone](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/dns/zone-setups/partial-setup/), each subdomain (regardless of level) has its own Universal SSL certificate and does not require additional features or purchases. As long as the subdomains are proxied to Cloudflare, a universal certificate [will be provisioned](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/universal-ssl/enable-universal-ssl/#partial-dns-setup). ## Certificate authority For Universal SSL certificates, Cloudflare chooses the certificate authority (CA) used for your certificate. Cloudflare can change the [certificate authority](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/reference/certificate-authorities/) without prior notification, and will not send any notification as the change happens. If you want to choose the issuing certificate authority, [order an advanced certificate](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/). ## Validity period For Universal certificates, Cloudflare controls the validity period. Refer to [validity periods and renewal](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/reference/certificate-validity-periods/#universal-ssl) for details. ## TLS settings [Customizing cipher suites](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/additional-options/cipher-suites/customize-cipher-suites/) is only available with [Advanced Certificate Manager](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/) or within [Cloudflare for SaaS](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/). You can set up [minimum TLS version](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/additional-options/minimum-tls/) at the zone level, but, for per-hostname settings, you must have [Advanced Certificate Manager](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/). ## Delegated DCV Delegated DCV allows zones with [partial DNS setups](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/dns/zone-setups/partial-setup/) to delegate the DCV process to Cloudflare. DCV delegation will not work with Universal SSL certificates and requires the use of an [advanced certificate](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/). ## Spectrum Universal SSL is not compatible with [Cloudflare Spectrum](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/spectrum/). If you are trying to use Spectrum, use either [an advanced certificate](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/) or [a custom certificate](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/custom-certificates/). ## Load balancing Due to internal limitations, Universal SSL certificates do not cover [load balancing hostnames](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/load-balancing/load-balancers/dns-records/) by default. This behavior will be corrected in the future. ## Browser support For more on browser support, see [Browser compatibility](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/reference/browser-compatibility/). ## SSL invalid brand check Some domains are not eligible for Universal SSL if they contain words that conflict with trademarked domains. To resolve this issue, you can: * Purchase an [advanced certificate](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/). * Upload your own [custom certificate](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/edge-certificates/custom-certificates/uploading/). ## Certificate pinning Cloudflare does not support HTTP public key pinning (HPKP) for universal, advanced, or custom hostname certificates. For details and recommended alternatives, refer to [Certificate pinning](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/ssl/reference/certificate-pinning/). Was this helpful? YesNo ## On this page [![](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/limitations/#page","headline":"Limitations for Universal SSL ยท Cloudflare SSL/TLS docs","description":"Review the limitations of Universal certificates, such as hostname coverage, certificate authority choice, and compatibility with other products.","url":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/limitations/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-08-24","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ```