Cloudflare Custom Domains & SSL

Attach custom domains to Workers/Pages with automatic SSL, no cert management or renewal.

CloudflareBeginner

Why

Cloudflare auto-provisions and renews SSL for custom domains — no Let's Encrypt, no certbot, no expiry incidents. Universal SSL covers all subdomains, edge certificates deploy in <5min.

Cloudflare's network spans 330+ cities in 125+ countries, serving 20% of all internet traffic. Workers have 0ms cold starts (isolate-based) and the free tier covers 100k requests/day.

When

Use for any production Worker/Pages needing branded domain. Avoid for non-HTTP services (SSL is HTTP-only) or domains not on Cloudflare DNS.

How

1. Add zone — dashboard → Add Site → enter domain → change nameservers 2. Worker route — wrangler.toml routes = [{ pattern = "api.example.com/*", zone_name = "example.com" }] 3. Pages domain — Pages → Custom domains → Add → verify via DNS 4. SSL mode — Full (strict) for origin cert, Flexible only for no-origin 5. Edge certs — auto-provisioned, or upload custom cert (Advanced Cert Manager) 6. CNAME — for Workers, add CNAME api → <worker>.<account>.workers.dev 7. Verify — curl -I https://api.example.com, check cf-ray header

Example

# wrangler.toml — custom domain route for Worker name = "my-api" main = "src/index.ts" routes = [ { pattern = "api.example.com/*", zone_name = "example.com" }, { pattern = "example.com/api/*", zone_name = "example.com" } ] # Terraform — Pages custom domain resource "cloudflare_pages_domain" "api" { account_id = var.account_id project_name = "my-pages-project" domain = "app.example.com" } # Verify SSL curl -I https://api.example.com # HTTP/2 200 # server: cloudflare # cf-ray: 8abc123-LAX ← served from edge

Common Problems

⚠DNS not on Cloudflare — custom domain requires zone on CF DNS, transfer first
⚠SSL mode Flexible insecure — decrypts at edge, plaintext to origin, use Full Strict
⚠CNAME flattening needed for apex — use CF's CNAME flattening for root domain

Best Practices

✓Use Full (strict) SSL — verify origin cert, prevents MITM between edge and origin
✓Enable Always Use HTTPS — auto-redirect 80→443, no insecure traffic
✓Use Advanced Cert Manager for EV/wildcard — needed for *.example.com on Workers

FAQ

What is Cloudflare Custom Domains & SSL and what problem does it solve?

Attach custom domains to Workers/Pages with automatic SSL, no cert management or renewal. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Cloudflare Custom Domains & SSL in 5 minutes?

Two steps to run it: (1) Add zone — dashboard → Add Site → enter domain → change nameservers; (2) Worker route — wrangler.toml routes = [{ pattern = "api.example.com/*", zone_name = "example.com" }]. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Cloudflare Custom Domains & SSL?

The most frequent issue is: DNS not on Cloudflare — custom domain requires zone on CF DNS, transfer first. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Cloudflare Custom Domains & SSL?

Best practices for Cloudflare Custom Domains & SSL include: Use Full (strict) SSL — verify origin cert, prevents MITM between edge and origin; Enable Always Use HTTPS — auto-redirect 80→443, no insecure traffic; Use Advanced Cert Manager for EV/wildcard — needed for *.example.com on Workers. The first one — "Use Full (strict) SSL — verify origin cert, prevents MITM between edge and origin" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Cloudflare Custom Domains & SSL?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Cloudflare Custom Domains & SSL options offer a free tier — validate within free quota before scaling.