---
id: "cloudflare-ssl-tls"
type: "component"
kind: "key-management"
provider: "cloudflare"
category: "security"
docs: "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/"
url: "https://localhost:3000/catalogue/components/cloudflare-ssl-tls"
---

# Cloudflare Universal SSL

Free domain-validated edge certificates issued and renewed automatically for every zone.

| | |
|---|---|
| Provider | [cloudflare](https://localhost:3000/catalogue?provider=cloudflare) |
| Kind | [Key management](https://localhost:3000/catalogue/kinds/key-management) |
| Category | Security |
| Official docs | [https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/) |

## Properties

| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| `encryptionMode` | enum | `automatic`, `off`, `flexible`, `full`, `full-strict`, `strict-origin-pull` | no | "automatic" | inherited |
| `envelopeEncryption` | boolean | — | no | false | inherited |
| `hostnameCoverage` | enum | `apex-and-first-level`, `all-subdomains` | no | "apex-and-first-level" | inherited |
| `hsm` | boolean | — | no | false | inherited |
| `managed` | boolean | — | no | true | **true** |
| `minimumTlsVersion` | enum | `1.0`, `1.1`, `1.2`, `1.3` | no | "1.0" | inherited |
| `rotationAutomated` | boolean | — | no | false | **true** |
| `rotationDays` | integer | — | no | — | inherited |
| `validationLevel` | enum | `dv`, `ov`, `ev` | no | "dv" | inherited |

Bold values are the ones this component pins.

## Rules that apply · 0

No rule selects this kind or its category.

## Other products of the same kind · 53

- [Certificate Management Service](https://localhost:3000/catalogue/components/alibaba-certificate-management.md) `alibaba-certificate-management` — alibabacloud
- [Data Encryption Service](https://localhost:3000/catalogue/components/alibaba-data-encryption-service.md) `alibaba-data-encryption-service` — alibabacloud
- [AWS Certificate Manager](https://localhost:3000/catalogue/components/aws-acm.md) `aws-acm` — aws
- [AWS KMS](https://localhost:3000/catalogue/components/aws-kms.md) `aws-kms` — aws
- [AWS Payment Cryptography](https://localhost:3000/catalogue/components/aws-payment-cryptography.md) `aws-payment-cryptography` — aws
- [AWS Private Certificate Authority](https://localhost:3000/catalogue/components/aws-private-ca.md) `aws-private-ca` — aws
- [AWS Secrets Manager](https://localhost:3000/catalogue/components/aws-secrets-manager.md) `aws-secrets-manager` — aws
- [AWS Signer](https://localhost:3000/catalogue/components/aws-signer.md) `aws-signer` — aws
- [AWS Systems Manager Parameter Store](https://localhost:3000/catalogue/components/aws-ssm-parameter-store.md) `aws-ssm-parameter-store` — aws
- [AWS CloudHSM](https://localhost:3000/catalogue/components/cloudhsm.md) `cloudhsm` — aws
- [Artifact Signing](https://localhost:3000/catalogue/components/azure-artifact-signing.md) `azure-artifact-signing` — azure
- [Azure Cloud HSM](https://localhost:3000/catalogue/components/azure-cloud-hsm.md) `azure-cloud-hsm` — azure
- [Azure Dedicated HSM](https://localhost:3000/catalogue/components/azure-dedicated-hsm.md) `azure-dedicated-hsm` — azure
- [Azure Key Vault](https://localhost:3000/catalogue/components/azure-key-vault.md) `azure-key-vault` — azure
- [Azure Key Vault Managed HSM](https://localhost:3000/catalogue/components/azure-managed-hsm.md) `azure-managed-hsm` — azure
- [Advanced Certificate Manager](https://localhost:3000/catalogue/components/cloudflare-advanced-certificate-manager.md) `cloudflare-advanced-certificate-manager` — cloudflare
- [Cloudflare Geo Key Manager](https://localhost:3000/catalogue/components/cloudflare-geo-key-manager.md) `cloudflare-geo-key-manager` — cloudflare
- [Cloudflare Keyless SSL](https://localhost:3000/catalogue/components/cloudflare-keyless-ssl.md) `cloudflare-keyless-ssl` — cloudflare
- [Cloudflare mTLS client certificates](https://localhost:3000/catalogue/components/cloudflare-mtls.md) `cloudflare-mtls` — cloudflare
- [Cloudflare Origin CA](https://localhost:3000/catalogue/components/cloudflare-origin-ca.md) `cloudflare-origin-ca` — cloudflare
- [Cloudflare Secrets Store](https://localhost:3000/catalogue/components/cloudflare-secrets-store.md) `cloudflare-secrets-store` — cloudflare
- [Bitwarden](https://localhost:3000/catalogue/components/bitwarden.md) `bitwarden` — default
- [cert-manager](https://localhost:3000/catalogue/components/cert-manager.md) `cert-manager` — default
- [CyberArk Conjur](https://localhost:3000/catalogue/components/conjur.md) `conjur` — default
- [Doppler](https://localhost:3000/catalogue/components/doppler.md) `doppler` — default
- [EJBCA](https://localhost:3000/catalogue/components/ejbca.md) `ejbca` — default
- [Entrust nShield HSM](https://localhost:3000/catalogue/components/entrust-nshield.md) `entrust-nshield` — default
- [HashiCorp Vault](https://localhost:3000/catalogue/components/hashicorp-vault.md) `hashicorp-vault` — default
- [HCP Vault Dedicated](https://localhost:3000/catalogue/components/hcp-vault.md) `hcp-vault` — default
- [Infisical](https://localhost:3000/catalogue/components/infisical.md) `infisical` — default
- [Generic key management](https://localhost:3000/catalogue/components/key-management.md) `key-management` — default
- [1Password Connect](https://localhost:3000/catalogue/components/onepassword-connect.md) `onepassword-connect` — default
- [OpenBao](https://localhost:3000/catalogue/components/openbao.md) `openbao` — default
- [Sealed Secrets](https://localhost:3000/catalogue/components/sealed-secrets.md) `sealed-secrets` — default
- [Smallstep step-ca](https://localhost:3000/catalogue/components/step-ca.md) `step-ca` — default
- [Thales Luna HSM](https://localhost:3000/catalogue/components/thales-luna-hsm.md) `thales-luna-hsm` — default
- [Certificate Authority Service](https://localhost:3000/catalogue/components/google-certificate-authority-service.md) `google-certificate-authority-service` — gcp
- [Certificate Manager](https://localhost:3000/catalogue/components/google-certificate-manager.md) `google-certificate-manager` — gcp
- [Cloud External Key Manager](https://localhost:3000/catalogue/components/google-cloud-ekm.md) `google-cloud-ekm` — gcp
- [Cloud HSM](https://localhost:3000/catalogue/components/google-cloud-hsm.md) `google-cloud-hsm` — gcp
- and 13 more: https://localhost:3000/catalogue/kinds/key-management.md

## Use it in a design

```yaml
nodes:
  - { id: "cloudflare-ssl-tls", component: "cloudflare-ssl-tls" }
```

## Source (`component` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../../schema/component.schema.json
# Cloudflare Universal SSL: free DV edge certificates issued and renewed automatically for every zone.
# "SSL/TLS encryption modes" and "TLS protocols": new zones default to Automatic SSL/TLS and to a
# minimum TLS version of 1.0; Universal SSL covers the apex and first-level subdomains only.
schemaVersion: "1"
type: "component"
id: "cloudflare-ssl-tls"
kind: "key-management"
provider: "cloudflare"
docs: "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/"
defaults:
  managed: true
  rotationAutomated: true
properties:
  encryptionMode:
    type: "enum"
    values: ["automatic", "off", "flexible", "full", "full-strict", "strict-origin-pull"]
    default: "automatic"
  minimumTlsVersion:
    type: "enum"
    values: ["1.0", "1.1", "1.2", "1.3"]
    default: "1.0"
  validationLevel:
    type: "enum"
    values: ["dv", "ov", "ev"]
    default: "dv"
  hostnameCoverage:
    type: "enum"
    values: ["apex-and-first-level", "all-subdomains"]
    default: "apex-and-first-level"
```

Human page: https://localhost:3000/catalogue/components/cloudflare-ssl-tls