Cloudflare Pages custom domain and certificate setup

Cloudflare Pages issues and renews the certificate for a custom domain by itself. After you add the domain in the Pages project, Cloudflare validates it over HTTP and issues a certificate from one of its partner CAs: Let's Encrypt, Google Trust Services or SSL.com.

An apex domain such as example.com must be a Cloudflare zone on the same account. A subdomain can stay on any DNS provider with a CNAME to <project>.pages.dev. Steps follow Cloudflare's documentation as of November 2026; my-site.pages.dev and example.com are examples.

At a glance

Step 1: Add the domain in the Pages project

Add the hostname in the Pages dashboard before you create any DNS record:

1. Go to Workers & Pages and select your Pages project.
2. Open Custom domains and select Set up a domain.
3. Enter the hostname and select Continue.

If you create a CNAME to my-site.pages.dev without associating the hostname in the Pages dashboard first, the hostname does not resolve to your project and visitors get a 522 error.

Step 2: Create the DNS records

Apex domain. Add example.com as a zone in your Cloudflare account and change the nameservers at the registrar to the two Cloudflare nameservers you are given. Once the zone is active, Pages creates the CNAME record for you when you confirm the domain.

Subdomain on external DNS. Add a CNAME at your DNS provider:

If the zone is already on Cloudflare, the record is added automatically. On an Enterprise zone, release any zone hold before adding the domain, because a hold prevents the custom domain from activating.

www and the apex together. Add the apex as the custom domain and redirect www to it. Cloudflare's guide uses a Bulk Redirect from www.example.com to https://example.com (status 301, with path and query preserved) plus a proxied placeholder record for www:

The placeholder address is never contacted; the proxy answers with the redirect. If you prefer to serve the site on both names, add www.example.com as a second custom domain instead.

Step 3: Check CAA records

If you publish CAA records that do not allow Cloudflare's CAs, the domain cannot get a certificate. The Pages documentation gives this set:

example.com.  300  IN  CAA  0 issue "letsencrypt.org"
example.com.  300  IN  CAA  0 issue "pki.goog; cansignhttpexchanges=yes"
example.com.  300  IN  CAA  0 issue "ssl.com"
example.com.  300  IN  CAA  0 issuewild "letsencrypt.org"
example.com.  300  IN  CAA  0 issuewild "pki.goog; cansignhttpexchanges=yes"
example.com.  300  IN  CAA  0 issuewild "ssl.com"

Keep any CA you use elsewhere on the domain as an extra issue record. Cloudflare's debugging guide notes that missing CAA entries are most likely when Universal SSL is disabled or when the domain uses an external DNS provider. Test with the CAA checker.

Wildcards and your own certificate

The Pages documentation only covers adding individual hostnames, so plan one custom domain per name. At zone level, Universal SSL on a full setup covers the apex and first-level subdomains; deeper names need Total TLS or an advanced certificate.

Pages has no field for uploading a certificate. Cloudflare's custom certificates are a zone-level feature meant for Business and Enterprise customers, and Cloudflare does not renew them for you. If you need a certificate from a particular CA for a Pages site, ask Cloudflare whether it applies to your Pages hostname before you buy one.

Verify

An active custom domain presents a certificate from one of Cloudflare's partner CAs for the exact hostname. Check it with the SSL checker or from a terminal:

curl ssl.sh/example.com

Then confirm the certificate and the issuing CA:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -subject -ext subjectAltName -dates

The issuer will be Let's Encrypt, Google Trust Services or SSL.com. All three are fine; do not pin to one of them.

Renewal

There is nothing to renew by hand. Cloudflare manages issuance and renewal; for Universal SSL it documents 90-day certificates with renewal starting 30 days before expiry. What can break it is DNS: if you point the hostname somewhere else, the Pages custom domain becomes inactive, and pointing it back means errors until it is active again. To divert traffic temporarily, use an Origin Rule or a redirect rule rather than editing the record. Public certificates are capped at 200 days today and at 100 days from March 15, 2027, which Cloudflare's 90-day certificates already meet. Add the domain to ssl.sh monitoring (in development) to catch an inactive domain early.

Troubleshooting: stuck in Verifying

When a domain does not move past the Verifying stage, work through Cloudflare's checklist.

Blocked HTTP validation. Pages must reach an HTTP endpoint on the domain. Cloudflare Access, a redirect, a Worker, a WAF custom rule or a Client-Side Security content rule in the way stops validation. Test the challenge path:

curl -s -o /dev/null -D - https://example.com/.well-known/acme-challenge/randomstring

A 302 to cloudflareaccess.com means Access is intercepting. Disable that Access policy (or redirect, or Worker) until the domain is verified, then turn it back on.

Missing CAA records. Run dig CAA example.com on the apex (or on the subdomain zone). A single 0 issue "amazon.com" record, for example, blocks every Cloudflare CA; add the six records above. See CAA record prevents issuance.

Zone hold. Release it during setup and reinstate it once the domain is active.

Errors only on the custom domain. If my-site.pages.dev works and the custom domain does not, your zone settings (caching, rules) apply to the proxied record. Switch the record to DNS only to confirm, then review the zone configuration.

If the domain is still verifying after 15 minutes with all of the above checked, contact Cloudflare support.