Cloudflare Certificate Signing Requests (CSRs): A Guide for Website Owners

Cloudflare’s Certificate Signing Requests (CSRs) feature is for a website owner who needs Cloudflare to generate a CSR and its associated private key before obtaining a certificate from a certificate authority (CA). In Cloudflare’s documented process, you create the CSR in the Edge Certificates dashboard, submit it to a CA, then upload the issued custom certificate back to Cloudflare using CSR encoding. Cloudflare states that the private key remains within its network.

What a CSR contains#

A CSR contains domain details such as the common name, organization information, and Subject Alternative Names (SANs). Cloudflare’s CSR feature generates the request and its associated private key. The private key is retained within Cloudflare’s network, according to Cloudflare’s documentation.

Choose the CSR scope#

Cloudflare documents two scopes:

• Zone-level: for a certificate associated with one Cloudflare zone.
• Account-level: for organizations issuing certificates across multiple domains.

Choose the scope that matches where the certificate will be used. A single-zone certificate generally calls for the zone-level option, while certificates issued across multiple domains may call for the account-level option described by Cloudflare.

Cloudflare’s documented workflow#

1. Open the Edge Certificates dashboard in Cloudflare and generate a CSR.
2. Submit the CSR to your chosen certificate authority.
3. Obtain the issued certificate from the CA.
4. Upload the issued custom certificate to Cloudflare using the CSR encoding mode.

Cloudflare notes that the CSR encoding option appears only after a CSR has been created. Before generating the request, review the domain name, organization details, and Subject Alternative Names that need to appear in it.

Renewal rule#

For renewal, Cloudflare instructs you to reuse the CSR associated with the existing certificate. A different CSR cannot be used with that same certificate. If you need to use a different CSR, you must upload a new certificate instead.

Edge certificates and origin certificates#

Cloudflare’s SSL/TLS documentation distinguishes between two certificate locations in its architecture:

• An edge certificate covers traffic between visitors and Cloudflare.
• An origin certificate covers traffic between Cloudflare and the origin server.

A CSR created through Cloudflare’s documented edge-certificate workflow therefore concerns the certificate used at Cloudflare’s edge. It should not be treated as a replacement for the certificate configured on the origin server.