Do not delete a Cloudflare Total TLS certificate as a routine renewal reset

Deletion can opt that hostname out of future automatic Total TLS orders.

Source facts

Cloudflare states that deleting a Total TLS certificate associated with a proxied hostname is interpreted as opting the hostname out, and no new Total TLS certificate is ordered for it. Deleting and recreating the DNS record does not reverse that behavior. The guide also excludes hostnames used with Tunnel, Load Balancing, and Spectrum from Total TLS issuance.

Source: Cloudflare — Total TLS.

Applicability

This concerns the documented Total TLS feature, which requires Advanced Certificate Manager and full DNS setup.

DSE recommendation

DSE recommends identifying the certificate type and hostname eligibility before attempting a cleanup or repair. Preserve metadata for the affected hostname and use the supported troubleshooting path instead of deleting the certificate speculatively. Maintain explicit certificate coverage for excluded product hostnames. Include the opt-out consequence in change review so a cosmetic dashboard cleanup does not become a later expiry incident. Add certificate deletion to the list of changes requiring an issuance-impact review. Ask the operator to name the replacement coverage before approving removal. Keep excluded-product hostnames in a separate certificate inventory with their actual issuer, rather than assuming the zone-wide Total TLS setting covers them.

Verification

Inspect the active certificate type and SAN coverage for each intended hostname, then verify the visitor-facing certificate with normal trust checks. In a test environment, follow the documented recovery process for any intentionally opted-out name. Record the resulting issuance state and avoid claiming that recreating DNS alone restores automatic certificate management.

Official reference

Cloudflare — Total TLS. Reviewed October 20, 2026.