Setup guide

Cloudflare DNS setup guide for sslcertificates.io

This guide explains how to connect Cloudflare DNS to sslcertificates.io, what credentials to prepare, and how to operate safely in Test (Let's Encrypt Staging) and Live (publicly trusted issuance) environments.

What this integration does

Cloudflare DNS is the reference DNS-01 connector. After you save a scoped token, sslcertificates.io verifies it, lists zones, selects the longest matching authoritative zone, creates an _acme-challenge TXT, reads that record back from the API, polls public DNS, records first_seen_at, uses it for ACME, then deletes only the stored record ID and verifies removal.

Category: DNS Providers. Public integration page: /integrations/cloudflare.

Outcomes

Publish DNS-01 challenges on Cloudflare DNS
Issue wildcard certificates
Remove challenge records after validation

Prerequisites

Active Cloudflare DNS account
API access that can create and delete TXT records
Zone:Zone:Read and Zone:DNS:Edit on the zones you want automated. A scoped token is required; Global API keys are rejected.

Authentication and credentials

Authentication mode in the catalog: api_token.

Fields the connection form expects: API token (required)

Store secrets in a password manager while you paste them once into sslcertificates.io. Values are encrypted at rest and are not shown again after save. Prefer narrowly scoped credentials over admin passwords.

Zone:Zone:Read and Zone:DNS:Edit on the zones you want automated. A scoped token is required; Global API keys are rejected.

Permissions (least privilege)

Zone:Zone:Read and Zone:DNS:Edit on the zones you want automated. A scoped token is required; Global API keys are rejected.

The connector never deletes TXT records it did not create. Cloudflare SSL for SaaS is a separate integration.

Connect in the workspace

Sign in to sslcertificates.io
Open Integrations
Choose Cloudflare DNS
Enter the connection details
Test the connection
Select the resources you want to manage

After Test connection succeeds, run Discover so the platform lists zones, subscriptions, domains, or deploy targets you are allowed to see. Select only resources this organization should manage.

Test vs Live certificate environments

sslcertificates.io is a production platform. Test and Live are your execution environments.

Test uses the official Let’s Encrypt Staging directory. Certificates are real ACME certificates and are not publicly trusted.
Live uses the official Let’s Encrypt Production directory for publicly trusted certificates.

Cloudflare connections are scoped to the selected environment. A Test token is not used for Live orders, and a Live token is not used for Test orders. Save and test a token in each environment you intend to automate. Do not copy credentials between environments unless you explicitly choose to reuse them.

Test still calls Cloudflare’s production DNS API against the zones you connect. A Test order can write a real _acme-challenge TXT record. That is expected, not a sandbox simulation.

Create separate Cloudflare tokens labeled Test and Live when the zones differ. Scope each token to Zone:DNS:Edit and Zone:Read on the intended zone only.

DNS-01 lifecycle on Cloudflare DNS

For DNS-01 validation the platform publishes a TXT record at _acme-challenge.<hostname>. The value is base64url(SHA256(keyAuthorization)) without padding (RFC 8555 §8.4) — 43 characters, no dot. It is not the raw token.thumbprint string shown as key authorization. After Let’s Encrypt accepts the challenge, the connector deletes only the stored Cloudflare record ID it created. Other TXT values on the same name, including concurrent apex and wildcard orders, are left untouched.

Wildcards such as *.example.com require DNS-01; HTTP-01 cannot validate them. If CAA records restrict which CAs may issue, fix CAA before ordering or issuance fails with a stable error — the platform does not silently choose another CA.

Check public resolvers for the TXT name before calling POST /api/v1/certificate-orders/{id}/validate. Propagation delays return dns_propagation_timeout; retry with backoff rather than spamming validate.

Example flow (Test)

Create a Test API key with certificates:write and integrations:write.
Connect Cloudflare DNS and select the hosted zone that contains your test hostname.
POST /api/v1/certificates with validation: dns-01 and environment: test.
Confirm the _acme-challenge TXT appears in Cloudflare DNS, then validate.
After issuance succeeds, confirm cleanup removed the owned TXT record.

Discovery

Discovery runs only after authentication succeeds. The integration enumerates resources the credential may read — hosted zones, subscriptions, domains, clusters, or load balancers depending on Cloudflare DNS. If discovery returns empty, the credential is usually too narrow or pointed at the wrong account or region.

Renewal and ongoing operation

When Cloudflare DNS participates in deployment or DNS automation, renewals re-use the same connection. Watch webhook events such as certificate.renewal_failed and verify the external endpoint after every replacement. A renewed certificate in inventory is not proof HTTPS serves the new leaf.

Disconnect and credential rotation

Open Workspace → Integrations → Cloudflare DNS → Disconnect to remove stored credentials from this organization. DNS integrations should delete only TXT records the platform created for ACME challenges. Rotate vendor tokens on a schedule; update the integration, run Test connection, and revoke the old credential at the vendor.

Troubleshooting

Symptom	Likely cause	What to do
Test connection fails immediately	Wrong host, region, or token	Re-copy credentials; confirm clock skew and TLS to the vendor API
Discovery is empty	Token cannot list the intended zone	Confirm Zone:Read on that zone. Do not grant account-wide DNS edit to “make discovery work”
Order stuck validating	DNS or HTTP challenge not public yet	Inspect the order challenges; wait for propagation; POST validate
Deploy reported success but HTTPS unchanged	Old cert still bound on the edge	Compare served SHA-256 to expected leaf; reload or bind again
`insufficient_scope` from sslcertificates.io API	API key missing abilities	Mint a key with integrations:write and certificates:write

Stable API error codes are documented at /docs/errors. Include X-Request-Id when contacting support.

Official vendor documentation

Continue

Back to Cloudflare DNS Create account