# Do not delete a Cloudflare Total TLS certificate as a routine renewal reset

> Deletion can opt that hostname out of future automatic Total TLS orders.

- Canonical URL: https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:52+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Deletion can opt that hostname out of future automatic Total TLS orders.

## Potentially affected

This concerns the documented Total TLS feature, which requires Advanced Certificate Manager and full DNS setup.

## DSE recommendation

DSE recommends identifying the certificate type and hostname eligibility before attempting a cleanup or repair.

## Article

Deletion can opt that hostname out of future automatic Total TLS orders.

## Source facts

Cloudflare states that deleting a Total TLS certificate associated with a proxied hostname is interpreted as opting the hostname out, and no new Total TLS certificate is ordered for it. Deleting and recreating the DNS record does not reverse that behavior. The guide also excludes hostnames used with Tunnel, Load Balancing, and Spectrum from Total TLS issuance.

Source: [Cloudflare — Total TLS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/).

## Applicability

This concerns the documented Total TLS feature, which requires Advanced Certificate Manager and full DNS setup.

## DSE recommendation

DSE recommends identifying the certificate type and hostname eligibility before attempting a cleanup or repair. Preserve metadata for the affected hostname and use the supported troubleshooting path instead of deleting the certificate speculatively. Maintain explicit certificate coverage for excluded product hostnames. Include the opt-out consequence in change review so a cosmetic dashboard cleanup does not become a later expiry incident. Add certificate deletion to the list of changes requiring an issuance-impact review. Ask the operator to name the replacement coverage before approving removal. Keep excluded-product hostnames in a separate certificate inventory with their actual issuer, rather than assuming the zone-wide Total TLS setting covers them.

## Verification

Inspect the active certificate type and SAN coverage for each intended hostname, then verify the visitor-facing certificate with normal trust checks. In a test environment, follow the documented recovery process for any intentionally opted-out name. Record the resulting issuance state and avoid claiming that recreating DNS alone restores automatic certificate management.

## Official reference

[Cloudflare — Total TLS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Total TLS
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Do not delete a Cloudflare Total TLS certificate as a routine renewal reset,” DSE Security, https://update.dsesecurity.com/updates/do-not-delete-a-cloudflare-total-tls-certificate-as-a-routine-renewal-reset/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.