CertificatePack

Certificate Pack

The Certificate Pack resource lets you create and manage Cloudflare Advanced Certificate Packs for flexible SSL/TLS certificates with multiple Certificate Authority options.

Important Requirements:

Advanced Certificate Manager (ACM) must be activated: Before using Certificate Packs, you must activate ACM in your Cloudflare dashboard. Navigate to your domain > SSL/TLS > Edge Certificates and click Activate for Advanced Certificate Manager. This requires a $10/month subscription per domain.
Requires a paid Cloudflare plan (not available on Free plans)
Certificate provisioning can take up to 10 minutes
Most properties are immutable after creation (only cloudflareBranding can be updated)

Basic Example

Create a basic certificate pack with Let’s Encrypt for your domain.

import { Zone, CertificatePack } from "alchemy/cloudflare";

const zone = await Zone("my-zone", {
  name: "example.com",
});

const basicCert = await CertificatePack("my-cert", {
  zone: zone,
  certificateAuthority: "lets_encrypt",
  hosts: ["example.com", "www.example.com"],
  validationMethod: "txt",
  validityDays: 90,
});

Enterprise Certificate with Google Trust Services

Create an enterprise-grade certificate with Google Trust Services and Cloudflare branding.

const enterpriseCert = await CertificatePack("enterprise-cert", {
  zone: "example.com", // Can use zone ID string or Zone resource
  certificateAuthority: "google",
  hosts: ["example.com", "*.example.com", "api.example.com"],
  validationMethod: "txt",
  validityDays: 365,
  cloudflareBranding: true,
});

Wildcard Certificate with SSL.com

Create a wildcard certificate using SSL.com with email validation.

const wildcardCert = await CertificatePack("wildcard-cert", {
  zone: myZone,
  certificateAuthority: "ssl_com",
  hosts: ["example.com", "*.example.com"],
  validationMethod: "email",
  validityDays: 365,
});

Multi-Domain Certificate

Create a certificate covering multiple subdomains with Let’s Encrypt.

const multiDomainCert = await CertificatePack("multi-cert", {
  zone: "example.com",
  certificateAuthority: "lets_encrypt",
  hosts: [
    "example.com",
    "www.example.com",
    "api.example.com",
    "admin.example.com",
    "blog.example.com"
  ],
  validationMethod: "http",
  validityDays: 90,
});

Properties

Property	Type	Required	Description
`zone`	`string \| Zone`	Yes	Zone resource or zone ID where the certificate will be created
`certificateAuthority`	`"google" \| "lets_encrypt" \| "ssl_com"`	Yes	Certificate Authority to use for issuing the certificate
`hosts`	`string[]`	Yes	List of hostnames (max 50, must include zone apex)
`validationMethod`	`"txt" \| "http" \| "email"`	Yes	Domain ownership validation method
`validityDays`	`14 \| 30 \| 90 \| 365`	Yes	Certificate validity period in days
`cloudflareBranding`	`boolean`	No	Add Cloudflare branding subdomain as Common Name (default: false)
`type`	`"advanced"`	No	Certificate type (only “advanced” supported, default: “advanced”)
`delete`	`boolean`	No	Whether to delete the certificate pack on destroy (default: true)

Certificate Authorities

Let’s Encrypt (`lets_encrypt`)

Cost: Free
Best for: Basic SSL needs, development environments
Validity: Shorter periods (14, 30, 90 days)
Features: Standard domain validation

Google Trust Services (`google`)

Cost: Paid
Best for: Enterprise applications, production environments
Validity: Up to 365 days
Features: Enhanced validation, enterprise support

SSL.com (`ssl_com`)

Cost: Commercial
Best for: Commercial applications requiring extended validation
Validity: Up to 365 days
Features: Extended validation options, commercial support

Validation Methods

TXT Record (`txt`)

Add DNS TXT record to prove domain ownership
Most reliable method for automation
Works with all domain configurations

HTTP File (`http`)

Upload verification file to domain’s web server
Requires web server access
Good for domains with existing websites

Email (`email`)

Receive validation email at admin addresses
Requires access to domain admin email
Manual validation process

Important Notes

Immutable Properties

Most certificate pack properties cannot be changed after creation. To modify these properties, you must delete and recreate the certificate pack:

Certificate Authority (certificateAuthority)
Hostnames (hosts)
Validation Method (validationMethod)
Validity Period (validityDays)
Type (type)

Updateable Properties

Only cloudflareBranding can be updated after creation:

// Update to enable Cloudflare branding
const updatedCert = await CertificatePack("my-cert", {
  zone: zone,
  certificateAuthority: "lets_encrypt", // Must match original
  hosts: ["example.com", "www.example.com"], // Must match original
  validationMethod: "txt", // Must match original
  validityDays: 90, // Must match original
  cloudflareBranding: true, // Only this can change
});

Host Requirements

Maximum 50 hostnames per certificate pack
Must include the zone apex (root domain)
Supports wildcards (e.g., *.example.com)
Cannot be empty

Provisioning Time

Certificate packs take time to provision and become active
Full deployment can take up to 10 minutes
Monitor the status property to track progress

Subscription Requirements

Advanced Certificate Packs require a paid Cloudflare plan. Free plans cannot create certificate packs and will receive subscription-related errors.

Status Values

Certificate packs progress through various status values during their lifecycle:

initializing - Certificate pack creation in progress
pending_validation - Waiting for domain validation
pending_issuance - Certificate being issued by CA
pending_deployment - Certificate being deployed to edge
active - Certificate is live and serving traffic
expired - Certificate has expired
deleted - Certificate pack has been deleted

Error states include *_timed_out variants when operations exceed time limits.

Helper Functions

Wait for Certificate to Become Active

import { waitForCertificatePackActive } from "alchemy/cloudflare/certificate-pack";

// Wait for certificate to become active (up to 10 minutes)
const finalStatus = await waitForCertificatePackActive(
  api,
  zone.id,
  certificatePack.id,
  10 * 60 * 1000 // 10 minutes timeout
);

console.log(`Certificate pack is now: ${finalStatus}`);