Cloudflare.Ssl reference

CertificatePack

Source: src/Cloudflare/Ssl/CertificatePack.ts

An Advanced Certificate Manager (ACM) certificate pack — an order for edge certificates covering a custom set of hostnames in a zone, with a choice of Certificate Authority, validation method, and validity period.

Requires the Advanced Certificate Manager subscription on the zone; ordering without it fails with the typed AdvancedCertificateManagerRequired error (Cloudflare code 1450).

Issuance is asynchronous: the resource returns as soon as the order is placed (status initializing/pending_validation) and does not wait for active, because validation may require you to create DNS records first — the outstanding records are exported as validationRecords.

The pack’s certificateAuthority, hosts, and validityDays are immutable — changing any of them replaces the pack (a new order). validationMethod and cloudflareBranding are updated in place.

CertificatePack: Ordering a certificate pack

Order an advanced certificate for the apex and a wildcard

const pack = yield* Cloudflare.Ssl.CertificatePack("ApexCert", {
  zoneId: zone.zoneId,
  certificateAuthority: "google",
  hosts: ["example.com", "*.example.com"],
  validationMethod: "txt",
  validityDays: 90,
});

Order from Let’s Encrypt with a short validity

yield* Cloudflare.Ssl.CertificatePack("ShortLivedCert", {
  zoneId: zone.zoneId,
  certificateAuthority: "lets_encrypt",
  hosts: ["example.com", "api.example.com"],
  validationMethod: "http",
  validityDays: 30,
});

CertificatePack: Completing validation

const pack = yield* Cloudflare.Ssl.CertificatePack("ApexCert", {
  zoneId: zone.zoneId,
  certificateAuthority: "google",
  hosts: ["example.com"],
  validationMethod: "txt",
  validityDays: 90,
});
// pack.validationRecords contains the txtName/txtValue pairs to create
// as DNS records so the CA can validate domain control.

UniversalSsl

Source: src/Cloudflare/Ssl/UniversalSsl.ts

The Universal SSL setting of a Cloudflare zone (/zones/{zone_id}/ssl/universal/settings).

Universal SSL is a zone singleton — the setting always exists (Cloudflare defaults it to enabled), so this resource never creates or deletes anything physical. Reconcile patches the setting when the observed value differs from the desired one; destroy restores the value the setting had before Alchemy first managed it (captured as initialEnabled).

Warning: disabling Universal SSL removes any active Universal SSL certificates for the zone from the edge. Visitors will see TLS errors unless advanced/custom certificates cover the zone’s hostnames.

UniversalSsl: Managing Universal SSL

Disable Universal SSL for a zone

yield* Cloudflare.Ssl.UniversalSsl("UniversalSsl", {
  zoneId: zone.zoneId,
  enabled: false,
});

Pin Universal SSL enabled

yield* Cloudflare.Ssl.UniversalSsl("UniversalSsl", {
  zoneId: zone.zoneId,
  enabled: true,
});