{"rid":"domains-dns/cloudflare-universal-ssl","card":{"rid":"domains-dns/cloudflare-universal-ssl","eid":"cloudflare","topic":"domains-dns","slug":"cloudflare-universal-ssl","provider":"Cloudflare Universal SSL","url":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/","domain":"cloudflare.com","category":"certificate authority","tier":null,"verdict":"qualifies-with-caveat","vorder":1,"grp":"usable","confidence":"reported","binding":"per-object-cap","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"rest","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-22T03:05:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-06","n_evidence":1,"usd_month":null,"usd_per_tb_month":null,"summary":"a free certificate on every zone, covering the apex and one level of subdomain","duplicate_of":null,"n_unknown":1},"record":{"topic":"domains-dns","slug":"cloudflare-universal-ssl","provider":"Cloudflare Universal SSL","url":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/","category":"certificate authority","free_tier":{"stated":"a free certificate on every zone, covering the apex and one level of subdomain","unit":"unlimited","source_url":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/","read_on":"2026-10-22","metered_on":"none"},"per_object_cap":{"stated":"covers example.com and app.example.com, not a.b.example.com; deeper names need Advanced Certificate Manager","bytes":null,"source_url":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/"},"retention":{"stated":"the certificate is issued and renewed by Cloudflare while the zone is active","days":null,"source_url":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/"},"egress":{"terms":"no charge","metered":false,"free_allowance":null,"price_per_tb":null,"source_url":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/"},"interface":["rest"],"interface_detail":"automatic on a proxied zone; no client API of its own, and the zone API reports the certificate","tooling":"nothing to run: the certificate appears on the zone","chaining":"the certificate half of the free endpoint, from the same account and zone as the DNS and the tunnel","limits":[{"kind":"per-object-cap","value":"one level of subdomain only; deeper names need Advanced Certificate Manager","source":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/"}],"binding":"per-object-cap","identity_cost":{"kind":"email","detail":"a Cloudflare account and a zone on Cloudflare nameservers","country":null},"reliability_note":"no reliability event recorded","confidence":"reported","confidence_note":"the one-level coverage limit is stated across Cloudflare's TLS documentation and repeated in third-party summaries; the product page was reached only as a stub, so this is reported.","evidence":[{"url":"https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/","date":"2026-10-22","proved":"Universal SSL is free on every plan; the one-level subdomain coverage limit and the Advanced Certificate Manager upgrade path are the substance"}],"verdict":"qualifies-with-caveat","verified_at":"2026-10-22T03:05:00.000Z","price_per_tb_month":null,"notes":"The one-level limit is the trap. A per-tenant scheme at tenant.app.example.com needs a paid certificate manager, or a wildcard from Let's Encrypt over DNS-01, which is free."},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:per-object-cap","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"}],"unknown":[["$.reliability_note","none-observed"]],"history":[],"drift":[]}