TLS Management·续

<details>

<summary>

Required API token permissions

</summary>

At least one of the following <a href="https://developers.cloudflare.com/fundamentals/api/reference/permissions/">token permissions</a> is required:

  • <code>SSL and Certificates Write</code>
  • <code>SSL and Certificates Read</code>

</details>

Custom Hostname Detailsbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames/$CUSTOM_HOSTNAME_ID" \
    --request GET \
    --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

Response examplejson

 "success": true,
  "result": {
    "id": "<CUSTOM_HOSTNAME_ID>",
    "ssl": {
      "id": "<CERTIFICATE_ID>",
      "bundle_method": "ubiquitous",
      "certificate_authority": "<CERTIFICATE_AUTHORITY>",
      "custom_certificate": "",
      "custom_csr_id": "",
      "custom_key": "",
      "expires_on": "",
      "hosts": [
        "app.example.com",
        "*.app.example.com"
      ],
      "issuer": "",
      "method": "http",
      "settings": {
        "ciphers": ["ECDHE-RSA-AES256-GCM-SHA384"],
        "early_hints": "on",
        "http2": "on",
        "min_tls_version": "1.2",
        "tls_1_3": "on"
      },
      "signature": "SHA256WithRSA",
      "type": "dv",
      "uploaded_on": "2020-02-06T18:11:23.531995Z",
      "validation_errors": [
        {
          "message": "SERVFAIL looking up CAA for app.example.com"
        }
      ],
      "validation_records": [
        {
          "emails": [
            "administrator@example.com",
            "webmaster@example.com"
          ],
          "http_body": "ca3-574923932a82475cb8592200f1a2a23d",
          "http_url": "http://app.example.com/.well-known/pki-validation/ca3-da12a1c25e7b48cf80408c6c1763b8a2.txt",
          "txt_name": "_acme-challenge.app.example.com",
          "txt_value": "810b7d5f01154524b961ba0cd578acc2"
        }
      ],
      "wildcard": false
    },
  }
  1. Copy the complete <code>ssl.settings</code> object. Change only <code>ciphers</code>, then make a <code>PATCH</code> request to the <a href="https://developers.cloudflare.com/api/resources/custom_hostnames/methods/edit/">Edit Custom Hostname</a> endpoint. Omit settings that were not present in the <code>GET</code> response.

<details>

<summary>

Required API token permissions

</summary>

At least one of the following <a href="https://developers.cloudflare.com/fundamentals/api/reference/permissions/">token permissions</a> is required:

  • <code>SSL and Certificates Write</code>

</details>

Edit Custom Hostnamebash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames/$CUSTOM_HOSTNAME_ID" \
    --request PATCH \
    --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    --json '{
        "ssl": {
                "settings": {
                        "ciphers": [
                                "ECDHE-ECDSA-AES128-GCM-SHA256",
                                "ECDHE-RSA-AES128-GCM-SHA256"
                        ],
                        "early_hints": "on",
                        "http2": "on",
                        "min_tls_version": "1.2",
                        "tls_1_3": "on"
                }
        }
    }'

</details>

<details>

<summary>

Restrict cipher suites for custom hostname with custom certificate

</summary>

In the API documentation, refer to <a href="https://developers.cloudflare.com/api/resources/custom_hostnames/methods/edit/">SSL properties of a custom hostname</a>. In the case of a custom hostname with custom certificate, you must include the custom certificate in the <a href="https://developers.cloudflare.com/api/resources/custom_hostnames/methods/edit/">Edit Custom Hostname PATCH call</a>, with the <code>settings</code> specifications where you must include <code>type</code> and <code>method</code> within the <code>ssl</code> object, as explained below.

  1. Make a <code>GET</code> request to the <a href="https://developers.cloudflare.com/api/resources/custom_hostnames/methods/get/">Custom Hostname Details</a> endpoint to check what are the current values for <code>ssl.type</code> and <code>ssl.method</code>.

<details>

<summary>

Required API token permissions

</summary>

At least one of the following <a href="https://developers.cloudflare.com/fundamentals/api/reference/permissions/">token permissions</a> is required:

  • <code>SSL and Certificates Write</code>
  • <code>SSL and Certificates Read</code>

</details>

Custom Hostname Detailsbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames/$CUSTOM_HOSTNAME_ID" \
    --request GET \
    --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

Response examplejson

 "success": true,
  "result": {
    "id": "<CUSTOM_HOSTNAME_ID>",
    "ssl": {
      "id": "<CERTIFICATE_ID>",
      "bundle_method": "ubiquitous",
      "certificate_authority": "<CERTIFICATE_AUTHORITY>",
      "custom_certificate": "",
      "custom_csr_id": "",
      "custom_key": "",
      "expires_on": "",
      "hosts": [
        "app.example.com",
        "*.app.example.com"
      ],
      "issuer": "",
      "method": "http",
      "settings": {},
      "signature": "SHA256WithRSA",
      "type": "dv",
      "uploaded_on": "2020-02-06T18:11:23.531995Z",
      "validation_errors": [
        {
          "message": "SERVFAIL looking up CAA for app.example.com"
        }
      ],
      "validation_records": [
        {
          "emails": [
            "administrator@example.com",
            "webmaster@example.com"
          ],
          "http_body": "ca3-574923932a82475cb8592200f1a2a23d",
          "http_url": "http://app.example.com/.well-known/pki-validation/ca3-da12a1c25e7b48cf80408c6c1763b8a2.txt",
          "txt_name": "_acme-challenge.app.example.com",
          "txt_value": "810b7d5f01154524b961ba0cd578acc2"
        }
      ],
      "wildcard": false
    },
  }
  1. After you take note of these values, make a <code>PATCH</code> request to the <a href="https://developers.cloudflare.com/api/resources/custom_hostnames/methods/edit/">Edit Custom Hostname</a> endpoint, providing both the list of authorized cipher suites and the same <code>type</code> and <code>method</code> values that you obtained from the previous step, but also the <code>custom_certificate</code> and <code>custom_key</code>.

<details>

<summary>

Required API token permissions

</summary>

At least one of the following <a href="https://developers.cloudflare.com/fundamentals/api/reference/permissions/">token permissions</a> is required:

  • <code>SSL and Certificates Write</code>

</details>

Edit Custom Hostnamebash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames/$CUSTOM_HOSTNAME_ID" \
    --request PATCH \
    --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    --json '{
        "ssl": {
                "method": "http",
                "type": "dv",
                "custom_certificate": "<CERTIFICATE_STRING>",
                "custom_key": "<CERTIFICATE_PRIVATE_KEY>",
                "settings": {
                        "ciphers": [
                                "ECDHE-ECDSA-AES128-GCM-SHA256",
                                "ECDHE-RSA-AES128-GCM-SHA256"
                        ],
                        "min_tls_version": "1.2"
                }
        }
    }'

</details>

Alerts for mutual TLS certificates

You can configure alerts to receive notifications before your mutual TLS certificates expire.

<details>

<summary>

Access mTLS Certificate Expiration Alert

</summary>

Who is it for?

<a href="https://developers.cloudflare.com/cloudflare-one/access-controls/policies/">Access</a> customers that use client certificates for mutual TLS authentication. This notification will be sent 30 and 14 days before the expiration of the certificate.

Other options / filters

None.

Included with

Purchase of <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/">Access</a> and/or <a href="https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls/">Cloudflare for SaaS</a>.

What should you do if you receive one?

Upload a <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/#add-mtls-authentication-to-your-access-configuration">renewed certificate</a>.

</details>

Refer to Cloudflare Notifications for more information on how to set up an alert.

Was this helpful?

YesNo

On this page

TLS Management·续 - 图1Docs

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls/#page","headline":"TLS Management","description":"Configure mTLS enforcement and minimum TLS version per custom hostname.","url":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls/og.png?v=f143e18a661b0d85","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["mTLS","TLS"]}

description: Cloudflare automatically issues certificates when you create a custom hostname. title: Issue image: https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/issue-certificates/og.png?v=898d723b3af42546

Skip to content

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-for-platforms/llms.txt
Use this file to discover all available pages before exploring further.