1. Noraina Tools
  2. AcmeWorker, certificate renewal with your own CA for Cloudflare

Cloudflare configuration

AcmeWorker, certificate renewal with your own CA for Cloudflare

AcmeWorker issues certificates from the certificate authority you choose, such as DigiCert or ZeroSSL, installs them as custom certificates on your Cloudflare zones and renews them before they expire. It is for organisations on Cloudflare Business or Enterprise that must use a CA Cloudflare does not issue from.

What it does

  1. Sign in with your Cloudflare account. AcmeWorker works with the access you grant on Cloudflare’s consent screen; there are no API tokens to create.
  2. Register an ACME account with your CA: its directory URL, a contact email and, if the CA requires it, the External Account Binding keys.
  3. Create a certificate: the domains, the zone to install it on, the ACME account and the key type (EC P-256 or RSA 2048). Choose EC P-256 to serve an ECC-only certificate instead of the ECC and RSA pair Cloudflare manages by default.
  4. AcmeWorker validates the domains with DNS records in your Cloudflare zone, gets the certificate from the CA, installs it under Edge Certificates as a custom certificate and removes the validation records.
  5. It checks every hour and renews each certificate before it expires, replacing the installed one. You can change the renewal window, the ACME account or the key type later, or force a renewal.

Optionally, a certificate can keep a downloadable copy of the latest certificate and private key, encrypted, to install elsewhere. You download it as PEM files or as a password-protected PKCS#12 (.p12) file.

Who it is for

Organisations that serve websites through Cloudflare but must use a specific CA, for example because their policy requires organisation-validated (OV) or extended validation (EV) certificates from DigiCert, and today renew those certificates by hand. Also for teams whose security policy does not accept RSA 2048 and who need an ECC-only certificate on Cloudflare.

Getting it

Talk to us about renewing your certificates with AcmeWorker, or open AcmeWorker if we have already set it up for you.

Independent tools built by Noraina, a Cloudflare Authorized Service Delivery Partner. Not made or operated by Cloudflare. Cloudflare is a trademark of Cloudflare, Inc.

Frequently asked questions

How can I renew a DigiCert certificate on Cloudflare automatically?

Register your DigiCert ACME account in AcmeWorker, with the External Account Binding keys from CertCentral, and create the certificate for your Cloudflare zone. AcmeWorker validates the domains through DNS, installs the certificate as a custom certificate and renews it 30 days before it expires, or at the interval you set. It can reissue or renew an existing DigiCert order instead of creating a new one.

Which certificate authorities does AcmeWorker support?

Any CA that supports the ACME protocol, including DigiCert and ZeroSSL, with External Account Binding when the CA requires it, and Let's Encrypt staging for tests. Let's Encrypt production is not supported, because Cloudflare already issues Let's Encrypt certificates on its own through Advanced Certificate Manager.

Where is the private key of the certificate kept?

When the zone has Advanced Certificate Manager, Cloudflare generates the private key and keeps it, so AcmeWorker never sees it. Otherwise AcmeWorker generates the key, installs it with the certificate and keeps no copy, unless you turn on a downloadable copy for that certificate.

Does AcmeWorker work if our DNS is not on Cloudflare?

Yes, for partial (CNAME setup) zones. You add one CNAME record for each domain's ACME challenge at your DNS provider, and AcmeWorker shows the exact record before it creates the certificate. Validation then runs through your Cloudflare zone.

Can I serve only ECC certificates on Cloudflare, without RSA?

Yes, on Business and Enterprise plans. The certificates Cloudflare manages for you come as a pair by default, ECC and RSA 2048, and some security policies do not accept RSA 2048. With AcmeWorker you issue an EC P-256 certificate on its own and install it as the zone's custom certificate, so visitors are served ECC only.

Which Cloudflare plan do I need?

A plan that allows custom certificates, which means Business or Enterprise. Advanced Certificate Manager is optional; with it, Cloudflare holds the private key.

Cloud your way

Talk to us Check your certification