01
Necessary Always on
Required for the site to work (login, preferences, security). Always on.
SECURITY · TLS
PROXY THE DOMAIN.LET'S ENCRYPT THE REST.
Proxy The Domain. Let'S Encrypt The Rest.
Auto-managed Let's Encrypt TLS for proxied domains. Domain-validated (DV) certificates issued and renewed automatically at the edge — no per-customer certificate console today.
DV VALIDATION
Auto RENEWAL
Proxied COVERAGE
Let's Encrypt ISSUER
TLS Coverage
One honest TLS model.
TLS issuance is bundled with proxied domains. No tiered certificate console today — auto-managed Let's Encrypt covers proxied hostnames.
Flow
Proxy the domain, then let it auto-issue.
A direct path from proxying a domain to automatic TLS issuance and renewal.
01
Proxy
Proxy The Domain
Point your domain through the Cloudflare-managed proxy. TLS issuance for proxied domains is automatic — no certificate request workflow required.
# tls.proxied
domain: app.example.eu
posture: proxied (orange cloud)
validation: DV (Let's Encrypt)
renewal: automatic
02
Issue
Let's Encrypt Auto-Issues TLS
Once your domain is proxied, Let's Encrypt issues and binds a TLS certificate automatically. Visitors get HTTPS without any manual setup.
edge.tls.auto-issue app.example.eu
resolving acme challenge...
issuing dv certificate...
OK certificate live at edge
OK https serving traffic
03
Renew
Auto-Renew Stays Out Of Your Way
Renewal happens transparently. There is no per-customer certificate console today — coverage applies to traffic proxied through the edge.
edge.tls.status
expiring in 30dtracked
auto-renewactive
validationdv
coverageproxied hostnames
What Works Today
Validation Domain Validation (DV) only
Issuer Let's Encrypt via Cloudflare edge
Renewal Automatic at the edge
Coverage Domains proxied through Altovar edge
What Is Not Available
EV / OV No EV or OV issuance
Custom CA No custom CA workflow
Origin certs No issuance for non-proxied origin servers
Console No per-customer certificate console
Renewal
Automation Auto-renew at the edge
Monitoring Edge validation state surfaced via dashboard
Alerts Operational notifications on edge events
Recovery Faster recovery for invalid DNS or ACME failures
Coming Next
ACME A real ACME issuer for non-proxied origins (planned)
Wildcards Wildcard issuance for proxied apex domains (planned)
API Certificate API for automation (planned)
Today Honest about scope — only auto-managed DV today
CLOUD
PROXY THE DOMAIN.LET'S ENCRYPT THE REST.
Auto-managed Let's Encrypt TLS for proxied domains. No certificate request workflow today.
PROXY A DOMAIN →