--- title: Decoding Cloudflare's SSL/TLS Pricing Options description: Discover Cloudflare SSL/TLS pricing options and choose the right plan for your website with up-to-date details for 2026. image: https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-May-10-2026-07-54-39-1325-AM.png --- [![BlazingCDN](https://blog.blazingcdn.com/hubfs/Logo/blog-logo-w.png)](https://blog.blazingcdn.com?hsLang=en-us) [๐Ÿ“˜Learn โ–พ](https://blog.blazingcdn.com/cdn-learn?hsLang=en-us) [CDN Fundamentals](https://blog.blazingcdn.com/cdn-fundamentals?hsLang=en-us) [By Content Type](https://blog.blazingcdn.com/by-content-type?hsLang=en-us) [Advanced Concepts](https://blog.blazingcdn.com/advanced-concepts?hsLang=en-us) [Glossary](https://blog.blazingcdn.com/glossary?hsLang=en-us) [โšก Web Performance](https://blog.blazingcdn.com/web-performance?hsLang=en-us) [๐ŸŽฌVideo & Streaming โ–พ](https://blog.blazingcdn.com/video-streaming-cdn?hsLang=en-us) [๐Ÿ”ด Live Streaming](https://blog.blazingcdn.com/live-streaming?hsLang=en-us) [๐Ÿ“บ VOD & OTT](https://blog.blazingcdn.com/vod-ott?hsLang=en-us) [๐Ÿ’ฐ Bandwidth & Costs](https://blog.blazingcdn.com/bandwidth-costs?hsLang=en-us) [๐Ÿญ Other Industries โ–พ](https://blog.blazingcdn.com/cdn-industry-insights?hsLang=en-us) [๐Ÿ“บ Media & Broadcasting](https://blog.blazingcdn.com/media-broadcasting?hsLang=en-us) [๐Ÿ’พ Software & SaaS](https://blog.blazingcdn.com/software-saas?hsLang=en-us) [๐Ÿ—๏ธ DevOps & Cloud Infra](https://blog.blazingcdn.com/devops-cloud-infra?hsLang=en-us) [๐Ÿ“š AdTech & Advertising](https://blog.blazingcdn.com/adtech-advertising?hsLang=en-us) [๐ŸŽฎ Gaming & Esports](https://blog.blazingcdn.com/gaming-esports?hsLang=en-us) [๐Ÿ“ฑ Mobile Apps & Developers](https://blog.blazingcdn.com/mobile-apps-developers?hsLang=en-us) [๐Ÿค– AI & Machine Learning](https://blog.blazingcdn.com/ai-machine-learning?hsLang=en-us) [๐Ÿ›๏ธ Enterprise & Corporate](https://blog.blazingcdn.com/enterprise-corporate?hsLang=en-us) [๐Ÿ“š E-Learning & EdTech](https://blog.blazingcdn.com/e-learning-edtech?hsLang=en-us) [๐ŸŸ๏ธ Sports & Live Events](https://blog.blazingcdn.com/sports-live-events?hsLang=en-us) [๐Ÿ’ฐ Pricing & Costs โ–พ](https://blog.blazingcdn.com/cdn-pricing-and-cdn-costs?hsLang=en-us) [Provider Pricing](https://blog.blazingcdn.com/provider-pricing?hsLang=en-us) [Cost Optimization](https://blog.blazingcdn.com/cost-optimization?hsLang=en-us) [Decision Support](https://blog.blazingcdn.com/decision-support?hsLang=en-us) [โšกCompare โ–พ](https://blog.blazingcdn.com/cdn-comparison?hsLang=en-us) [Provider Comparisons](https://blog.blazingcdn.com/provider-comparisons?hsLang=en-us) [Strategy Comparisons](https://blog.blazingcdn.com/strategy-comparisons?hsLang=en-us) [Ratings & Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐Ÿ“Š Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐Ÿ”’ Security โ–พ](https://blog.blazingcdn.com/cdn-security?hsLang=en-us) [Attack Protection](https://blog.blazingcdn.com/attack-protection?hsLang=en-us) [Encryption & Access](https://blog.blazingcdn.com/encryption-access?hsLang=en-us) [Video & DRM Security](https://blog.blazingcdn.com/video-drm-security?hsLang=en-us) [๐Ÿ“ Case Studies](https://blog.blazingcdn.com/case-studies?hsLang=en-us) [๐Ÿ”Œ Integrations](https://blog.blazingcdn.com/integrations?hsLang=en-us) [๐Ÿ› ๏ธ Tools](https://blog.blazingcdn.com/cdn-tools?hsLang=en-us) [Get Started](https://blazingcdn.com/sign-up-contact-form/) [Security](https://blog.blazingcdn.com/en-us/tag/security) [Pricing - Provider Pricing](https://blog.blazingcdn.com/en-us/tag/pricing-provider-pricing) [Learn - Advanced Concepts](https://blog.blazingcdn.com/en-us/tag/learn-advanced-concepts) [Security - Encryption & Access](https://blog.blazingcdn.com/en-us/tag/security-encryption-access) # Cloudflare SSL/TLS Pricing in 2026: Free vs Pro vs Businessโ€”What You Actually Pay BlazingCDN Nov 25, 2024, 5:42:12โ€ฏPM ![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-May-10-2026-07-54-39-1325-AM.png) # Cloudflare SSL Pricing in 2026: Plan-by-Plan Cost Breakdown As of May 2026, Cloudflare's Universal SSL still ships free on every zone โ€” but the moment you need a custom hostname, a client certificate, or a non-standard cipher policy, the bill jumps to $10/month, $20/month, or $200/month faster than most teams expect. Understanding **Cloudflare SSL pricing** at the feature boundary level, not just the plan-tier level, is the difference between a clean infrastructure budget and a surprise line item in your next quarterly review. This article gives you the exact per-plan costs as of Q2 2026, a feature-by-feature comparison table, a workload-profile decision matrix you won't find elsewhere, and a clear picture of where Cloudflare's TLS pricing sits relative to alternatives. ![Cloudflare SSL TLS pricing comparison chart for 2026](https://blog.blazingcdn.com/hs-fs/hubfs/Gemini%20INBlog%20Pictures/image-May-10-2026-07-54-52-5215-AM.png?width=1280&height=720&name=image-May-10-2026-07-54-52-5215-AM.png) ## **Cloudflare SSL Pricing by Plan in 2026** Cloudflare bundles SSL/TLS into its broader plan tiers rather than selling standalone certificates. That bundling makes the effective cost of TLS invisible until you need a feature locked behind a higher tier. Here is what each plan actually includes as of Q2 2026. ### Free Plan โ€” $0/month You get a Universal SSL certificate (DV, issued by Cloudflare's CA partner) covering your apex and one level of subdomain. TLS 1.2 and 1.3 are supported. You can toggle between Flexible, Full, and Full (Strict) modes. There is no option for client certificates, no custom certificate upload, and no Advanced Certificate Manager access. Edge certificate renewal is automatic. For a personal site or a staging environment, this is sufficient. For anything with compliance requirements or multi-level subdomain coverage, it is not. ### Pro Plan โ€” $20/month The Pro tier adds the Web Application Firewall ruleset and improved DDoS mitigation. On the TLS side, the practical upgrade is minor: you still get Universal SSL, still limited to first-level subdomain coverage. The Pro plan does not include Advanced Certificate Manager. If you assumed $20/month buys you custom certificate support, check again. The real TLS unlock at this tier is access to the WAF, which lets you enforce stricter transport policies via custom rules โ€” blocking TLS 1.0/1.1 clients, for example โ€” but the certificate itself is the same DV Universal cert. ### Business Plan โ€” $200/month This is where **Cloudflare SSL certificate pricing** changes meaningfully. Business customers can upload their own custom SSL certificates, which means you can bring your OV or EV cert from a third-party CA and terminate it at the Cloudflare edge. You also get priority support and stronger SLA-backed DDoS mitigation. However, even at $200/month, Advanced Certificate Manager is a separate add-on. ### Enterprise Plan โ€” Custom Pricing Enterprise contracts are negotiated. Published list prices do not exist. In practice, expect annual commitments starting in the low five figures, though the range varies wildly depending on traffic volume, number of zones, and bundled services. Enterprise unlocks dedicated certificates, Keyless SSL, custom cipher suite ordering, and full API control over certificate lifecycle. If your compliance posture requires FIPS 140-2 validated key storage or you run mutual TLS at the edge for service-to-service auth, this is the tier where Cloudflare supports it. ### Advanced Certificate Manager โ€” $10/month per zone This is the line item most teams miss. ACM is available on any paid plan (Pro, Business, Enterprise) and costs $10/month per zone. It gives you control over certificate authority selection, certificate validity period, cipher suite preference, wildcard coverage, and multi-level subdomain support. If you need a certificate covering \*.api.example.com (second-level wildcard), ACM is the minimum required purchase. As of 2026, ACM also supports certificate pinning removal and faster issuance via Cloudflare's own CA. | Feature | Free ($0) | Pro ($20) | Business ($200) | Enterprise (Custom) | | --- | --- | --- | --- | --- | | Universal SSL (DV) | Yes | Yes | Yes | Yes | | Custom certificate upload | No | No | Yes | Yes | | Advanced Certificate Manager | No | +$10/mo | +$10/mo | Included | | Wildcard on subdomains (multi-level) | No | ACM required | ACM required | Yes | | Keyless SSL | No | No | No | Yes | | Dedicated certificates | No | No | No | Yes | | TLS 1.3 support | Yes | Yes | Yes | Yes | | Minimum TLS version enforcement | TLS 1.0+ | TLS 1.0+ (WAF rules) | TLS 1.0+ (WAF rules) | Configurable per-hostname | ## **How Cloudflare TLS Pricing Compares to Alternatives in 2026** Cloudflare's model is unusual because TLS is embedded in a platform bundle, not sold as a standalone product. That makes apples-to-apples comparison tricky, but here are the relevant reference points as of 2026: **Let's Encrypt** remains free and automated via ACME. It issues DV certificates only, with 90-day lifetimes (soon moving to 6-day short-lived certs under their 2026 roadmap). If you run your own edge infrastructure and have certbot or an ACME client baked into your deployment pipeline, Let's Encrypt costs zero. The trade-off is operational: you own renewal, revocation, and monitoring. No WAF, no DDoS mitigation, no managed edge. **DigiCert** remains the dominant choice for OV/EV certificates in regulated industries. Single-domain OV certificates start around $200โ€“$300/year as of 2026. Wildcard OV runs $500โ€“$700/year. You pay for the certificate, then separately for wherever you terminate it. DigiCert does not bundle delivery infrastructure. **AWS Certificate Manager (ACM)** issues free public DV certificates when used with AWS services (CloudFront, ALB, API Gateway). If your stack is already AWS-native, the effective TLS cost is $0 for the certificate and whatever you pay for the delivery service. CloudFront pricing starts at $0.085/GB for the first 10 TB, declining with volume. ## **Workload-Profile Decision Matrix: Which Cloudflare SSL Plan Fits** This is the section missing from every other pricing breakdown. Instead of mapping plans to vague business sizes ("small," "growing," "large"), map them to actual workload characteristics. | Workload Profile | Recommended Plan | Effective Monthly TLS Cost | Key Constraint | | --- | --- | --- | --- | | Single-domain marketing site, no compliance requirements | Free | $0 | No custom cert, no multi-level wildcard | | SaaS product with \*.app.example.com subdomains | Pro + ACM | $30 | No custom cert upload; ACM covers wildcard | | E-commerce with OV/EV cert requirement (PCI DSS) | Business | $200 + third-party cert cost | Upload your own OV/EV; Cloudflare terminates it | | Multi-tenant platform with custom vanity domains (SSL for SaaS) | Enterprise | Negotiated (typically $5K+/mo with Cloudflare for SaaS) | API-driven cert provisioning per customer domain | | Financial services with Keyless SSL + HSM integration | Enterprise | Negotiated | Private key never leaves your infrastructure | The decision pivot is usually not "how big is my company" but rather: do I need multi-level subdomain coverage, and do I need to bring my own certificate? If either answer is yes, you are paying $30/month minimum (Pro + ACM) and likely $200/month or more. ## **The Hidden Cost: Delivery Bandwidth Beyond TLS** Cloudflare's Free and Pro plans include unmetered bandwidth, which is genuinely unusual and a major cost advantage. But for teams already evaluating CDN spend separately from TLS spend, it is worth noting that the total cost of delivering encrypted traffic is certificate cost plus delivery cost. Cloudflare bundles both. Most other providers do not. If your architecture splits edge delivery from certificate management โ€” say, you terminate TLS at your own infrastructure or use a dedicated CDN โ€” you can pair Let's Encrypt or ACM certificates with a high-performance CDN at volume-based rates. [**BlazingCDN**](https://blazingcdn.com/pricing/) delivers stability and fault tolerance comparable to Amazon CloudFront at significantly lower cost, starting at $4/TB ($0.004/GB) and scaling down to $2/TB at 2 PB+ monthly commitment. For teams pushing 100+ TB/month of TLS-terminated traffic, that separation of concerns can cut delivery costs by 50% or more versus an all-in-one platform, while maintaining 100% uptime SLA and flexible configuration for demand spikes. ## **What Changed in 2026 for Cloudflare SSL Plans** Two shifts matter for anyone reassessing their TLS posture on Cloudflare this year: **1. ACM now defaults to Cloudflare's own CA for faster issuance.** Previously, ACM certificates were primarily issued via Let's Encrypt or DigiCert as backing CAs. As of early 2026, Cloudflare's own publicly trusted CA is the default for ACM-issued certs, reducing issuance latency and giving Cloudflare more control over the certificate lifecycle. This matters if you have automation that checks issuer fields or if you pin to a specific CA chain. **2. TLS 1.0 and 1.1 are now off by default on all plans.** Cloudflare previously allowed Free plan users to serve TLS 1.0 clients. As of Q1 2026, the minimum default is TLS 1.2 across all tiers, aligning with browser deprecation timelines. If you had legacy IoT or embedded clients negotiating TLS 1.0, they are now failing on Cloudflare unless you are on Enterprise and have explicitly requested a policy exception. ## **FAQ** ### How much does Cloudflare SSL cost on the free plan? Zero. The Free plan includes a Universal SSL certificate (DV) covering your apex domain and first-level subdomains. Renewal is automatic. There is no charge for TLS termination or bandwidth on the Free tier as of 2026. ### Is Cloudflare Advanced Certificate Manager pricing separate from the plan fee? Yes. ACM costs $10/month per zone and is available on any paid plan (Pro, Business, or Enterprise). It is not included in the $20/month Pro plan or the $200/month Business plan by default. Enterprise contracts sometimes bundle it at no additional charge, but this varies by negotiation. ### Does the Cloudflare Business plan include custom SSL certificate upload? Yes. Business ($200/month) is the lowest tier that allows you to upload your own SSL certificate โ€” OV, EV, or any DV cert issued by a third-party CA. You purchase the certificate separately from your CA and upload it via the Cloudflare dashboard or API. ### Can I use Cloudflare's free SSL for a subdomain like api.staging.example.com? No. Universal SSL on the Free plan covers only first-level subdomains (e.g., api.example.com). Multi-level subdomains like api.staging.example.com require Advanced Certificate Manager ($10/month) on a paid plan to issue a wildcard or SAN certificate that covers deeper subdomain levels. ### What is the cheapest Cloudflare plan for wildcard SSL? Pro ($20/month) plus Advanced Certificate Manager ($10/month) for a total of $30/month per zone. This gives you wildcard coverage including multi-level subdomains. The Free plan does not support wildcard certificates at all. ### How does Cloudflare SSL pricing compare to buying a certificate from DigiCert? A DigiCert OV wildcard certificate costs roughly $500โ€“$700/year as of 2026. Cloudflare's Business plan at $200/month ($2,400/year) includes the ability to upload that DigiCert cert plus edge delivery, WAF, and DDoS mitigation. If you only need DV and do not need OV/EV, Cloudflare's Free or Pro + ACM ($30/month) is dramatically cheaper. ## **Next Step: Audit Your TLS Spend This Week** Pull up your Cloudflare dashboard and check two things: how many zones have ACM enabled, and how many are on the Free plan but actually serving multi-level subdomains (they are failing silently or falling back to HTTP in some client configurations). Run `openssl s_client` against your deepest subdomain and verify the cert SAN list covers it. If it does not, you now know exactly which plan boundary you have hit and what the fix costs. If you are running multiple zones, multiply the ACM add-on accordingly โ€” that $10/zone adds up fast at 20+ zones and is worth modeling against alternatives where certificate management and delivery are priced independently. Share: [f](https://www.facebook.com/sharer/sharer.php?u=https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options) [in](https://www.linkedin.com/sharing/share-offsite/?url=https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options) [๐•](https://twitter.com/intent/tweet?url=https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options&text=) [โœ‰](mailto:?subject=%3Cspan%20id="hs_cos_wrapper_name"%20class="hs_cos_wrapper%20hs_cos_wrapper_meta_field%20hs_cos_wrapper_type_text"%20style=""%20data-hs-cos-general-type="meta_field"%20data-hs-cos-type="text"%20%3ECloudflare%20SSL/TLS%20Pricing%20in%202026:%20Free%20vs%20Pro%20vs%20Businessโ€”What%20You%20Actually%20Pay%3C/span%3E&body=https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options) ![BlazingCDN](https://blog.blazingcdn.com/hs-fs/hubfs/Logo/blog-logo-w.png?height=24&name=blog-logo-w.png) *Heavy traffic.* Light bill. The CDN for video and large traffic Their monthly bill vs ours - 20 TBFastly $2,087**$92.50** - 50 TBCDN77 $990**$215** - 200 TBCloudFront $11,965**$765** Published list prices, Aug 2026 [Calculate your cost](https://blazingcdn.com/cdn-cost-calculator/?utm_source=blog&utm_medium=sidebar&utm_campaign=blog_sidebar&utm_content=compare_calc) ## Related posts [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Sep-21-2026-07-30-27-5571-AM.jpeg)](https://blog.blazingcdn.com/en-us/tls-1-3-and-0-rtt-at-the-edge-the-real-handshake-cost?hsLang=en-us) Learn ### [TLS 1.3 and 0-RTT at the Edge: The Real Handshake Cost](https://blog.blazingcdn.com/en-us/tls-1-3-and-0-rtt-at-the-edge-the-real-handshake-cost?hsLang=en-us) TLS 1.3 removes exactly one round trip from a full handshake compared with TLS 1.2, and 0-RTT removes one more on ... Sep 21, 2026, 9:33:42โ€ฏAM [Read more](https://blog.blazingcdn.com/en-us/tls-1-3-and-0-rtt-at-the-edge-the-real-handshake-cost?hsLang=en-us) [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Sep-20-2026-07-30-23-3710-AM.jpeg)](https://blog.blazingcdn.com/en-us/anycast-vs-dns-routing-how-a-cdn-picks-the-pop?hsLang=en-us) Learn ### [Anycast vs DNS Routing: How a CDN Picks the PoP](https://blog.blazingcdn.com/en-us/anycast-vs-dns-routing-how-a-cdn-picks-the-pop?hsLang=en-us) Evaluated February 2026. Two mechanisms decide which edge serves a request, and they fail on completely different ... Sep 20, 2026, 9:33:54โ€ฏAM [Read more](https://blog.blazingcdn.com/en-us/anycast-vs-dns-routing-how-a-cdn-picks-the-pop?hsLang=en-us) [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Sep-20-2026-07-00-33-3709-AM.jpeg)](https://blog.blazingcdn.com/en-us/understanding-cloudflares-rate-limiting-pricing?hsLang=en-us) Security ### [Cloudflare Rate Limiting Pricing 2026: Plans, Rules and Real Costs](https://blog.blazingcdn.com/en-us/understanding-cloudflares-rate-limiting-pricing?hsLang=en-us) Cloudflare Rate Limiting Pricing 2026: Plans, Rules, Real Costs Cloudflare rate limiting pricing has one detail that ... Sep 20, 2026, 9:02:12โ€ฏAM [Read more](https://blog.blazingcdn.com/en-us/understanding-cloudflares-rate-limiting-pricing?hsLang=en-us) [![BlazingCDN](https://blog.blazingcdn.com/hubfs/Logo/blog-logo-w.png)](https://blog.blazingcdn.com?hsLang=en-us) [๐Ÿ“˜ Learn](https://blog.blazingcdn.com/cdn-learn?hsLang=en-us) [๐Ÿ“Š Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐ŸŽฌ Video & Streaming](https://blog.blazingcdn.com/video-streaming-cdn?hsLang=en-us) [๐Ÿญ Industries](https://blog.blazingcdn.com/cdn-industry-insights?hsLang=en-us) [๐Ÿ’ฐ Pricing & Costs](https://blog.blazingcdn.com/cdn-pricing-and-cdn-costs?hsLang=en-us) [โšก Compare](https://blog.blazingcdn.com/cdn-comparison?hsLang=en-us) [๐Ÿ”’ Security](https://blog.blazingcdn.com/cdn-security?hsLang=en-us) [๐Ÿ› ๏ธ Tools](https://blog.blazingcdn.com/cdn-tools?hsLang=en-us) [โœ๏ธ Publish with us](https://blog.blazingcdn.com/publish-with-us?hsLang=en-us) in f ๐• โœ‰ Copyright ยฉ BlazingCDN |. All rights reserved. ![](https://matomo.blazingcdn.com/matomo.php?idsite=1&rec=1) ```json { "@context" : "https://schema.org", "@id" : "https://blazingcdn.com/#organization", "@type" : "Organization", "description" : "High-volume CDN for video, live streaming, OTT/IPTV, software, games, SaaS and large-file delivery.", "logo" : { "@id" : "https://blazingcdn.com/#logo", "@type" : "ImageObject", "height" : 560, "url" : "https://blazingcdn.com/wp-content/uploads/2024/08/logo-560-560.png", "width" : 560 }, "name" : "BlazingCDN", "sameAs" : [ "https://www.linkedin.com/company/68261278", "https://x.com/BlazingCdn", "https://twitter.com/BlazingCdn", "https://www.facebook.com/BlazingCDN", "https://www.reddit.com/r/BlazingCDN/" ], "url" : "https://blazingcdn.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/#website", "@type" : "WebSite", "inLanguage" : "en-US", "name" : "BlazingCDN Blog", "publisher" : { "@id" : "https://blazingcdn.com/#organization" }, "url" : "https://blog.blazingcdn.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options#article", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "BlazingCDN" }, "dateModified" : "2026-05-10T07:57:29Z", "datePublished" : "2024-11-25T16:42:12Z", "description" : "Discover Cloudflare SSL/TLS pricing options and choose the right plan for your website with up-to-date details for 2026.", "headline" : "Decoding Cloudflare's SSL/TLS Pricing Options", "image" : "https://143144902.fs1.hubspotusercontent-eu1.net/hubfs/143144902/Gemini-Blog/image-May-10-2026-07-54-39-1325-AM.png", "inLanguage" : "en-us", "isPartOf" : { "@id" : "https://blog.blazingcdn.com/#website" }, "mainEntityOfPage" : { "@id" : "https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options", "@type" : "WebPage" }, "publisher" : { "@id" : "https://blazingcdn.com/#organization" }, "wordCount" : 1922 } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options#breadcrumb", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://blog.blazingcdn.com/en-us", "name" : "Blog", "position" : 1 }, { "@type" : "ListItem", "item" : "https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options", "name" : "Decoding Cloudflare's SSL/TLS Pricing Options", "position" : 2 } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/decoding-cloudflares-ssl-tls-pricing-options#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Zero. The Free plan includes a Universal SSL certificate (DV) covering your apex domain and first-level subdomains. Renewal is automatic. There is no charge for TLS termination or bandwidth on the Free tier as of 2026." }, "name" : "How much does Cloudflare SSL cost on the free plan?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. ACM costs $10/month per zone and is available on any paid plan (Pro, Business, or Enterprise). It is not included in the $20/month Pro plan or the $200/month Business plan by default. Enterprise contracts sometimes bundle it at no additional charge, but this varies by negotiation." }, "name" : "Is Cloudflare Advanced Certificate Manager pricing separate from the plan fee?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Business ($200/month) is the lowest tier that allows you to upload your own SSL certificate โ€” OV, EV, or any DV cert issued by a third-party CA. You purchase the certificate separately from your CA and upload it via the Cloudflare dashboard or API." }, "name" : "Does the Cloudflare Business plan include custom SSL certificate upload?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Universal SSL on the Free plan covers only first-level subdomains (e.g., api.example.com). Multi-level subdomains like api.staging.example.com require Advanced Certificate Manager ($10/month) on a paid plan to issue a wildcard or SAN certificate that covers deeper subdomain levels." }, "name" : "Can I use Cloudflare's free SSL for a subdomain like api.staging.example.com?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Pro ($20/month) plus Advanced Certificate Manager ($10/month) for a total of $30/month per zone. This gives you wildcard coverage including multi-level subdomains. The Free plan does not support wildcard certificates at all." }, "name" : "What is the cheapest Cloudflare plan for wildcard SSL?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A DigiCert OV wildcard certificate costs roughly $500โ€“$700/year as of 2026. Cloudflare's Business plan at $200/month ($2,400/year) includes the ability to upload that DigiCert cert plus edge delivery, WAF, and DDoS mitigation. If you only need DV and do not need OV/EV, Cloudflare's Free or Pro + ACM ($30/month) is dramatically cheaper." }, "name" : "How does Cloudflare SSL pricing compare to buying a certificate from DigiCert?" } ] } ```