Cloudflare.Acm reference

CustomTrustStore

Source: src/Cloudflare/Acm/CustomTrustStore.ts

A root CA certificate in a zone’s custom origin trust store (/zones/{zone_id}/acm/custom_trust_store). Cloudflare uses the trust store to validate your origin server’s certificate when connecting to the origin (e.g. with Full (strict) SSL and a private CA at the origin).

Requires the Advanced Certificate Manager entitlement on the zone — without it every call fails with the typed AdvancedCertificateManagerRequired (code 1450) error.

The certificate is immutable: there is no update API, so changing the PEM (or the zone) replaces the resource. Trust store certificates carry no ownership markers, so a cold read scans the zone for a certificate with the same PEM body and reports it as Unowned — the engine refuses to take it over unless --adopt (or adopt(true)) is set.

CustomTrustStore: Uploading a root CA

Trust a private root CA for origin pulls

const trustStore = yield* Cloudflare.Acm.CustomTrustStore("OriginRootCa", {
  zoneId: zone.zoneId,
  certificate: rootCaPem, // "-----BEGIN CERTIFICATE-----\n..."
});

Load the PEM from a file

const fs = yield* FileSystem.FileSystem;
const pem = yield* fs.readFileString("./certs/root-ca.pem");
yield* Cloudflare.Acm.CustomTrustStore("OriginRootCa", {
  zoneId: zone.zoneId,
  certificate: pem,
});

TotalTls

Source: src/Cloudflare/Acm/TotalTls.ts

The Total TLS setting of a Cloudflare zone (/zones/{zone_id}/acm/total_tls).

Total TLS orders a hostname-specific TLS certificate for every proxied A, AAAA, or CNAME record in the zone, covering deep subdomains that the universal certificate’s single-level wildcard cannot. The setting is a zone singleton — it always exists (default disabled), so this resource never creates or deletes anything physical. Reconcile posts the setting when the observed state differs from the desired one; destroy restores the state the zone had before Alchemy first managed it (captured as initialEnabled / initialCertificateAuthority).

Entitlement-gated: configuring Total TLS requires the Advanced Certificate Manager add-on on the zone. Without it, every write fails with the typed AdvancedCertificateManagerRequired (code 1450) error (reads succeed and report enabled: false).

Only one TotalTls resource per zone makes sense — two instances managing the same zone would fight over the singleton.

TotalTls: Managing Total TLS

Enable Total TLS on a zone

const zone = yield* Cloudflare.Zone.Zone("Site", { name: "example.com" });

yield* Cloudflare.Acm.TotalTls("TotalTls", {
  zoneId: zone.zoneId,
  enabled: true,
});

Pin the issuing Certificate Authority

yield* Cloudflare.Acm.TotalTls("TotalTls", {
  zoneId: zone.zoneId,
  enabled: true,
  certificateAuthority: "lets_encrypt",
});