I am looking for clarification/guidance on the following.

I have www.example.com installed on CMS powered by Cloudflare CDN.

I want to secure subdomains used for other applications hosted on separate servers (non Cloudflare):

  • app.example.com
  • servide.example.com
  • mail.example.com

The CMS powered by Cloudflare has an SSL certificate issued for www.example.com, and tells me that existing certificates cannot be repurposed for their system and their certificate cannot cover content not hosted by them.

My understanding is unless this certificate is not installed on the main domain (www.example.com) we cannot apply on other sub-domains. Is that correct?

In other words, is it possible to have the CMS-provided certificate under www.example.com on their server and use a wildcard certificate to secure all other subdomains on separate servers at the same time?


As far as name-checking is concerned, a client simply checks that the name it addresses the server by matches the list of names embedded within the certificate that the server presents.

The client has no way of knowing if another server, somewhere on the Internet, has the same name in the SAN.

Note that there is unlikely to be any confusion caused by this as DNS ensures that only one of the servers will be accessible.

That is, if www.example.com in DNS points to your non-Cloudflare provided service the client will connect to that service and be presented with the *.example.com certificate. This will pass the name-matching test and should therefore succeed.

If you now change your DNS settings to point www.example.com to the Cloudflare server, the client will be presented the Cloudflare provided certificate (with www.example.com only) and as the names match, it will still be happy.

Meanwhile, any non-www.example.com names (app, servide, mail etc.) will point to the non-Cloudflare server in DNS and will happily use the *.example.com certificate.


You use Cloudflare certs for Cloudflare services. Just forget about it and let it "just work".

You purchase and use an external cert for external services as needed like you would with any other DNS server. With the exceptions of the A and CAA records hosted at Cloudflare they don't touch at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.