Skip to content

[Support Feedback] Improve certificate pinning, cipher suite, and Universal SSL docs (SSL/TLS)#28995

Merged
RebeccaTamachiro merged 6 commits intocloudflare:productionfrom
dmmulroy:support-macros/ssl
Mar 24, 2026
Merged

[Support Feedback] Improve certificate pinning, cipher suite, and Universal SSL docs (SSL/TLS)#28995
RebeccaTamachiro merged 6 commits intocloudflare:productionfrom
dmmulroy:support-macros/ssl

Conversation

@dmmulroy
Copy link
Contributor

Summary

Improves SSL/TLS documentation for common support topics, based on an audit of active support macros.

Changes

  • Certificate pinning: Clarify that pinning to Cloudflare edge certificates is not supported and document alternatives (pin to origin, use Authenticated Origin Pulls)
  • Cipher suite customization: Document prerequisites and plan requirements for custom cipher suites
  • Universal SSL subdomain limitations: Clarify coverage depth and SAN limits for Universal SSL certificates

Context

These changes are driven by recurring support cases. If you want to see the underlying support data (macro frequency, case volume by topic), reach out to @dmmulroy internally.

@elithrar
Copy link
Collaborator

/bonk review this and suggest any fixes

Copy link
Contributor

@ask-bonk ask-bonk bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One issue to address: the opening paragraph and the new Prerequisites note both mention Advanced Certificate Manager, creating redundancy. Two minor style suggestions also included. Otherwise the changes are accurate and well-structured improvements for these support-heavy topics.

@ask-bonk
Copy link
Contributor

ask-bonk bot commented Mar 16, 2026

Review posted. Here's a summary of the feedback:

MEDIUM (1 item):

  • customize-cipher-suites/index.mdx:14 — The intro paragraph says "With an Advanced Certificate Manager subscription…" but the new Prerequisites note right below it lists both ACM and Cloudflare for SaaS as options. Suggested making the intro product-agnostic to avoid redundancy.

LOW (2 items):

  • customize-cipher-suites/index.mdx:32 — The new sentence listing API endpoints is dense. Suggested splitting it into two sentences for readability.
  • certificate-pinning.mdx:15 — "Refer to" phrasing for the blog post link, per style guide conventions.

No build breakers, no broken links, no MDX syntax issues. All internal links resolve to existing pages. The content improvements across all three files are accurate and well-targeted at the support topics described.

github run

@dmmulroy dmmulroy force-pushed the support-macros/ssl branch from 7d60ada to 46ff9d6 Compare March 17, 2026 15:29
@RebeccaTamachiro
Copy link
Contributor

Thanks for the PR, @dmmulroy 👍 I think the majority of it looks good but flagging to @ngayerie for an extra set of eyes.

Copy link
Contributor

@RebeccaTamachiro RebeccaTamachiro Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just not really convinced about these changes to /customize-cipher-suites/index.mdx: the reason is that having CF4SaaS is not really a prerequisite for this guide in particular, and we actually point SaaS providers wanting to customize ciphers for their custom hostnames away from this page. So for this, let's maybe:
1- keep the previous version, with the shorter intro and separate note for SaaS providers
2- add notes about the ACM prereq to the specific how-to pages nested under this, instead

What do you think?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Applied the changes. Checked in with Nic via chat.

@RebeccaTamachiro RebeccaTamachiro merged commit 3cfb5f5 into cloudflare:production Mar 24, 2026
13 checks passed
RebeccaTamachiro added a commit to dmmulroy/cloudflare-docs that referenced this pull request Mar 24, 2026
dmmulroy pushed a commit to dmmulroy/cloudflare-docs that referenced this pull request Mar 24, 2026
ranbel pushed a commit that referenced this pull request Mar 24, 2026
…udflare One) (#28997)

* docs(cloudflare-one): improve tunnel, WARP, and SSO troubleshooting from support macro audit SPM-3037

* docs(tunnel): move support info section to bottom per reviewer feedback (nikitacano)

* fix(cloudflare-one): correct tunnel firewall requirements, update IdP navigation path

* docs(tunnel): move prereqs from top intro per reviewer feedback

* Revert changes to customize-cipher-suites as per #28995

* fix(cloudflare-one): address review feedback from nikitacano and ranbel

- Remove duplicated 'Information to provide for support' section
- Merge tunnel-specific support items (tunnel ID, cloudflared version, setup method) into the existing warp/support-ticket-best-practices partial
- Keep 'Collect debug logs' section under existing 'How do I contact support?' heading
- Reference the partial checklist instead of duplicating it

---------

Co-authored-by: Rebecca Tamachiro <rtamachiro@cloudflare.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

product:ssl Related to SSL size/s

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants