Cloudflare Universal SSL

Free allowance: A free certificate on every zone, covering the apex and one level of subdomain
Verdict: caveatusable, with a named limit or an unprobed read path
Cost: free tier
Identity: emailno card, no phone
Binding limit: per-object-capone level of subdomain only; deeper names need Advanced Certificate Manager
Evidence: reported1 source; a third party said so
Freshness: stale on 2026-11-07checked 2026-10-23 (live); stale on 2026-11-07

Free tier	a free certificate on every zone, covering the apex and one level of subdomain unit unlimited; metered on none
Price	none stated
Limits	per-object-cap (binding) one level of subdomain only; deeper names need Advanced Certificate Manager source
Identity	email a Cloudflare account and a zone on Cloudflare nameservers
Egress	no charge
Per-object cap	covers example.com and app.example.com, not a.b.example.com; deeper names need Advanced Certificate Manager
Retention	the certificate is issued and renewed by Cloudflare while the zone is active
Interface	rest automatic on a proxied zone; no client API of its own, and the zone API reports the certificate
Tooling	nothing to run: the certificate appears on the zone
Composes with	the certificate half of the free endpoint, from the same account and zone as the DNS and the tunnel
Reliability	no reliability event recorded
Notes	The one-level limit is the trap. A per-tenant scheme at tenant.app.example.com needs a paid certificate manager, or a wildcard from Let's Encrypt over DNS-01, which is free.
Evidence note	reported the one-level coverage limit is stated across Cloudflare's TLS documentation and repeated in third-party summaries; the product page was reached only as a stub, so this is reported.

Evidence 1

date	source	what it proved
2026-10-22	developers.cloudflare.com/ssl/edge-certificates/universal-ss	Universal SSL is free on every plan; the one-level subdomain coverage limit and the Advanced Certificate Manager upgrade path are the substance

Unknown values 1