Cloudflare 15-Year Free SSL Certificate: Application Guide

1. Introduction

Recently, many users have asked about SSL certificates, and quite a few are frustrated that free certificates from platforms such as Alibaba Cloud and Tencent Cloud only last 3 months and need frequent renewal. With that in mind, this article details the application process for Cloudflare's 15-year free SSL certificate, which supports wildcard domains and gives users a new option.

2. Why Choose the Cloudflare 15-Year Free SSL Certificate

Compared with other free certificates' 3-month validity, Cloudflare's 15-year certificate has notable characteristics. Here's an analysis from both the pros and cons:

(1) Advantages

• Completely free, valid for up to 15 years.
• Supports wildcard domains.
• Free access to Cloudflare's CDN service.
• Protects the origin server IP and improves website security.

(2) Things to note

• Your domain's DNS must be hosted on Cloudflare.
• Access speed from mainland China may be somewhat affected.
• Some features of certain hosting providers may not work.

3. Preparation

Before you start, make sure the following conditions are met:

1. You have a Cloudflare account; register at: https://www.cloudflare.com/.
2. Your domain has been added to your Cloudflare account.
3. Your domain's DNS is hosted on Cloudflare: at your registrar, change the DNS settings to use Cloudflare's nameservers, for example: coco.ns.cloudflare.com, shane.ns.cloudflare.com.
4. Choose a suitable plan; free users can simply scroll to the bottom of the page and select the FREE plan.

4. Detailed Application Steps

(1) Log in and enter the certificate application page

From the domain list, select the domain you want a certificate for, find and click “SSL/TLS” in the left menu, go to the “Origin Server” tab, and click the “Create Certificate” button.

(2) Configure the certificate parameters

1. Generate private key and CSR: you can let Cloudflare generate the private key and CSR — recommended for beginners; the key type can be RSA or ECC.
2. Configure the certificate's domain scope: enter the hostnames you want SSL protection for; wildcards are supported (e.g., *.example.com), and by default the apex domain and first-level wildcard are included. To add other levels of the domain, such as one.two.example.com, add them here.
3. Choose the certificate validity: the default is 15 years; you can shorten it as needed.
4. Choose the key format: PEM for Apache/Nginx servers; PKCS#7 for Windows/Tomcat servers.

(3) Save the certificate information

After clicking Create and generating the certificate, immediately copy the private key and certificate content to a safe location. We recommend creating two separate text files named “private.key” (private key) and “certificate.pem” (certificate).

⚠️ Important: once you leave the certificate generation page, the private key can no longer be viewed — be sure to save it.

5. Certificate Deployment Steps

(1) Install the certificate on your server

Log in to your server control panel (such as 1Panel), find the certificate feature, choose to upload a certificate, paste in the private key and certificate content respectively, and complete the installation.

(2) Configure the CA root certificate (as needed)

If your server needs it, download and install the corresponding root certificate:

• ECC version: Cloudflare Origin ECC PEM
• RSA version: Cloudflare Origin RSA PEM

Note: Apache cPanel users should not use the ECC version.

(3) Cloudflare dashboard configuration

Return to the SSL/TLS settings page, enable “Authenticated Origin Pulls”, then switch to the “Overview” tab and choose an appropriate encryption mode: “Full (strict)” or “Full (strict SSL origin pull)”.