{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/", "item": { "id": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/", "slug": "do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset", "url": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset.md", "json": "https://update.dsesecurity.com/api/v1/posts/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/" }, "title": "Do not delete a Cloudflare Total TLS certificate as a routine renewal reset", "summary": "Deletion can opt that hostname out of future automatic Total TLS orders.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:52+00:00", "modified_at": "2026-10-20T18:34:36+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 258, "potentially_affected": "This concerns the documented Total TLS feature, which requires Advanced Certificate Manager and full DNS setup.", "dse_recommendation": "DSE recommends identifying the certificate type and hostname eligibility before attempting a cleanup or repair.", "primary_source": { "name": "Cloudflare — Total TLS", "url": "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Deletion can opt that hostname out of future automatic Total TLS orders.

\n

Source facts

\n

Cloudflare states that deleting a Total TLS certificate associated with a proxied hostname is interpreted as opting the hostname out, and no new Total TLS certificate is ordered for it. Deleting and recreating the DNS record does not reverse that behavior. The guide also excludes hostnames used with Tunnel, Load Balancing, and Spectrum from Total TLS issuance.

\n

Source: Cloudflare — Total TLS.

\n

Applicability

\n

This concerns the documented Total TLS feature, which requires Advanced Certificate Manager and full DNS setup.

\n

DSE recommendation

\n

DSE recommends identifying the certificate type and hostname eligibility before attempting a cleanup or repair. Preserve metadata for the affected hostname and use the supported troubleshooting path instead of deleting the certificate speculatively. Maintain explicit certificate coverage for excluded product hostnames. Include the opt-out consequence in change review so a cosmetic dashboard cleanup does not become a later expiry incident. Add certificate deletion to the list of changes requiring an issuance-impact review. Ask the operator to name the replacement coverage before approving removal. Keep excluded-product hostnames in a separate certificate inventory with their actual issuer, rather than assuming the zone-wide Total TLS setting covers them.

\n

Verification

\n

Inspect the active certificate type and SAN coverage for each intended hostname, then verify the visitor-facing certificate with normal trust checks. In a test environment, follow the documented recovery process for any intentionally opted-out name. Record the resulting issuance state and avoid claiming that recreating DNS alone restores automatic certificate management.

\n

Official reference

\n

Cloudflare — Total TLS. Reviewed October 20, 2026.

", "content_text": "Deletion can opt that hostname out of future automatic Total TLS orders.\nSource facts\nCloudflare states that deleting a Total TLS certificate associated with a proxied hostname is interpreted as opting the hostname out, and no new Total TLS certificate is ordered for it. Deleting and recreating the DNS record does not reverse that behavior. The guide also excludes hostnames used with Tunnel, Load Balancing, and Spectrum from Total TLS issuance.\nSource: Cloudflare — Total TLS.\nApplicability\nThis concerns the documented Total TLS feature, which requires Advanced Certificate Manager and full DNS setup.\nDSE recommendation\nDSE recommends identifying the certificate type and hostname eligibility before attempting a cleanup or repair. Preserve metadata for the affected hostname and use the supported troubleshooting path instead of deleting the certificate speculatively. Maintain explicit certificate coverage for excluded product hostnames. Include the opt-out consequence in change review so a cosmetic dashboard cleanup does not become a later expiry incident. Add certificate deletion to the list of changes requiring an issuance-impact review. Ask the operator to name the replacement coverage before approving removal. Keep excluded-product hostnames in a separate certificate inventory with their actual issuer, rather than assuming the zone-wide Total TLS setting covers them.\nVerification\nInspect the active certificate type and SAN coverage for each intended hostname, then verify the visitor-facing certificate with normal trust checks. In a test environment, follow the documented recovery process for any intentionally opted-out name. Record the resulting issuance state and avoid claiming that recreating DNS alone restores automatic certificate management.\nOfficial reference\nCloudflare — Total TLS. Reviewed October 20, 2026.", "content_markdown": "Deletion can opt that hostname out of future automatic Total TLS orders.\n\n## Source facts\n\nCloudflare states that deleting a Total TLS certificate associated with a proxied hostname is interpreted as opting the hostname out, and no new Total TLS certificate is ordered for it. Deleting and recreating the DNS record does not reverse that behavior. The guide also excludes hostnames used with Tunnel, Load Balancing, and Spectrum from Total TLS issuance.\n\nSource: [Cloudflare — Total TLS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/).\n\n## Applicability\n\nThis concerns the documented Total TLS feature, which requires Advanced Certificate Manager and full DNS setup.\n\n## DSE recommendation\n\nDSE recommends identifying the certificate type and hostname eligibility before attempting a cleanup or repair. Preserve metadata for the affected hostname and use the supported troubleshooting path instead of deleting the certificate speculatively. Maintain explicit certificate coverage for excluded product hostnames. Include the opt-out consequence in change review so a cosmetic dashboard cleanup does not become a later expiry incident. Add certificate deletion to the list of changes requiring an issuance-impact review. Ask the operator to name the replacement coverage before approving removal. Keep excluded-product hostnames in a separate certificate inventory with their actual issuer, rather than assuming the zone-wide Total TLS setting covers them.\n\n## Verification\n\nInspect the active certificate type and SAN coverage for each intended hostname, then verify the visitor-facing certificate with normal trust checks. In a test environment, follow the documented recovery process for any intentionally opted-out name. Record the resulting issuance state and avoid claiming that recreating DNS alone restores automatic certificate management.\n\n## Official reference\n\n[Cloudflare — Total TLS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/", "url": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Do not delete a Cloudflare Total TLS certificate as a routine renewal reset", "item": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/#article", "identifier": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/", "url": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/", "headline": "Do not delete a Cloudflare Total TLS certificate as a routine renewal reset", "description": "Deletion can opt that hostname out of future automatic Total TLS orders.", "abstract": "Deletion can opt that hostname out of future automatic Total TLS orders.", "articleBody": "Deletion can opt that hostname out of future automatic Total TLS orders.\nSource facts\nCloudflare states that deleting a Total TLS certificate associated with a proxied hostname is interpreted as opting the hostname out, and no new Total TLS certificate is ordered for it. Deleting and recreating the DNS record does not reverse that behavior. The guide also excludes hostnames used with Tunnel, Load Balancing, and Spectrum from Total TLS issuance.\nSource: Cloudflare — Total TLS.\nApplicability\nThis concerns the documented Total TLS feature, which requires Advanced Certificate Manager and full DNS setup.\nDSE recommendation\nDSE recommends identifying the certificate type and hostname eligibility before attempting a cleanup or repair. Preserve metadata for the affected hostname and use the supported troubleshooting path instead of deleting the certificate speculatively. Maintain explicit certificate coverage for excluded product hostnames. Include the opt-out consequence in change review so a cosmetic dashboard cleanup does not become a later expiry incident. Add certificate deletion to the list of changes requiring an issuance-impact review. Ask the operator to name the replacement coverage before approving removal. Keep excluded-product hostnames in a separate certificate inventory with their actual issuer, rather than assuming the zone-wide Total TLS setting covers them.\nVerification\nInspect the active certificate type and SAN coverage for each intended hostname, then verify the visitor-facing certificate with normal trust checks. In a test environment, follow the documented recovery process for any intentionally opted-out name. Record the resulting issuance state and avoid claiming that recreating DNS alone restores automatic certificate management.\nOfficial reference\nCloudflare — Total TLS. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:52+00:00", "dateModified": "2026-10-20T18:34:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not delete a Cloudflare Total TLS certificate as a routine renewal reset" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 258, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Total TLS", "url": "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/" } } ] } }