Cloudflare Origin CA Certificate

Issue a free Cloudflare Origin CA certificate to encrypt the connection between Cloudflare's edge and your origin server (the "Full (Strict)" SSL mode).

What Gets Created

  • A cloudflare_origin_ca_certificate valid for the requested hostnames.
  • When no CSR is supplied: a generated private key + CSR (via the tls provider), with the key exported as a sensitive output.

Prerequisites

  • A Cloudflare API token with SSL and Certificates permission (the deprecated Origin CA Key is not required).

Configuration Reference

Required

  • hostnames — the SANs the certificate covers (e.g. the zone apex and a wildcard).

Optional

  • requestType — origin-rsa (default), origin-ecc, or keyless-certificate.
  • requestedValidity — 7, 30, 90, 365, 730, 1095, or 5475 days (default 5475).
  • csr — supply your own CSR to keep your key private (no key is generated).

Stack Outputs

OutputDescription
certificate_idThe certificate identifier
certificateThe issued certificate (PEM)
private_keyThe generated private key (PEM, sensitive); empty if a CSR was supplied
expires_onExpiry timestamp

Related Components

  • CloudflareDnsRecord, CloudflareDnsZone

Next article

Cloudflare Pages Project

Cloudflare Pages Project Host a static site or full-stack app (static assets + Pages Functions) on Cloudflare's edge, with a connected git repository for automatic builds or direct uploads of a pre-built site. What Gets Created A cloudflarepagesproject (the project), with its build configuration, optional git source, and per-environment deployment configuration (bindings, env vars, compatibility, limits). One cloudflarepagesdomain per attached custom domain. Prerequisites A Cloudflare account...
Read next article