Sign in to Next-Gen Trust Security.
Click Insights > Certificate Installations > Machines.
Click the more options button at the end of the machine's row, and then select Provision.
In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.
The rest of the Provision a certificate dialog appears after you select a certificate.
Under Certificate Information, in Zone, enter the name of the Cloudflare zone, exactly as it appears in your Cloudflare account.
(Optional) In Description, enter a description of the installation. Next-Gen Trust Security doesn't send the description to Cloudflare.
For Bundle Method, choose how Cloudflare builds the certificate chain that it serves:
User Defined: Next-Gen Trust Security sends the certificate's issuing chain with the certificate, and Cloudflare serves that chain as supplied.
Modern: Cloudflare builds the shortest chain with the newest intermediate certificates.
Compatible: Cloudflare builds the chain that the widest range of clients trusts. This is the default.
With Modern and Compatible, Next-Gen Trust Security sends only the certificate, and Cloudflare supplies the intermediate certificates.
For Certificate Pack Type, choose the type of certificate pack to create:
Auto: Cloudflare chooses the pack type. This is the default.
Modern (sni_custom): a custom certificate served to clients that support Server Name Indication (SNI).
Legacy (legacy_custom): a custom certificate that's also served to clients that don't support SNI.
Next-Gen Trust Security uses the pack type only when it creates a new certificate pack. When it updates an existing pack, the pack keeps its type.
(Optional) In Certificate Pack ID, enter the ID of an existing certificate pack in the zone to replace its certificate. If you leave it empty, Next-Gen Trust Security creates a new certificate pack the first time it pushes the certificate and then fills in the pack ID. Renewals update the same pack.
Note: If your Cloudflare plan supports dual certificate packs, you can serve both an RSA and an ECDSA certificate from one pack. Provision the first certificate, and then provision the second certificate to the same zone with the first pack's ID in Certificate Pack ID.
(Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
Click Save. To save and then provision another certificate, click Save & New.
After you save, an installation appears on the machine's
Installations tab. When the certificate is pushed, Next-Gen Trust Security creates or updates the custom certificate in the zone. If the certificate pack that the installation uses no longer exists, Next-Gen Trust Security adds the certificate to a pack in the zone that covers the same hostnames and holds a certificate of the other key type. If there's no such pack, it creates a new one. To provision on a schedule instead of right away, set up a
machine provisioning schedule.
