CustomCertificate

Source: src/Cloudflare/CustomCertificate/CustomCertificate.ts

A Cloudflare custom (BYO) edge certificate — upload your own SSL certificate and private key to be served at Cloudflare’s edge for a zone.

Custom certificates are a Business / Enterprise feature; on lower plans every API call fails with the typed PlanLevelNotAllowed error (Cloudflare error code 1011).

The certificate id is stable across in-place rotations: PATCHing a new certificate/privateKey pair keeps the same id. Cloudflare never echoes the PEM contents back, so a SHA-256 content hash of the pair is persisted in the attributes and used as the rotation diff baseline. Only zoneId and type force a replacement.

Uploading a certificate

Basic SNI certificate

const cert = yield* Cloudflare.CustomCertificate.CustomCertificate("EdgeCert", {
  zoneId: zone.zoneId,
  certificate: certPem,
  privateKey: Redacted.make(keyPem),
  type: "sni_custom",
});

Optimal bundle with a Geo Key Manager region

yield* Cloudflare.CustomCertificate.CustomCertificate("EuCert", {
  zoneId: zone.zoneId,
  certificate: certPem,
  privateKey: Redacted.make(keyPem),
  type: "sni_custom",
  bundleMethod: "optimal",
  geoRestrictions: { label: "eu" },
});

Rotating the certificate

// Changing `certificate`/`privateKey` PATCHes the same certificate id —
// no replacement, no coverage gap.
yield* Cloudflare.CustomCertificate.CustomCertificate("EdgeCert", {
  zoneId: zone.zoneId,
  certificate: renewedCertPem,
  privateKey: Redacted.make(renewedKeyPem),
  type: "sni_custom",
});

Prioritizing overlapping certificates

// Higher priority breaks ties across overlapping legacy_custom certs.
yield* Cloudflare.CustomCertificate.CustomCertificate("PrimaryCert", {
  zoneId: zone.zoneId,
  certificate: certPem,
  privateKey: Redacted.make(keyPem),
  priority: 1,
});