Skip to content

Create a Cloudflare machine

Create a Cloudflare machine so Certificate Manager - SaaS can discover the custom certificates in your Cloudflare zones and provision certificates to them. There are two Cloudflare machine types. One runs the connector in the cloud, and the other runs it on a VSatellite in your network.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • If you want the connector to run on a VSatellite, an active VSatellite that can reach the Cloudflare API and the hostnames in your zones on port 443.
  • A Cloudflare user API token that can access the zones where you want to discover or provision certificates, and that has permission to read and manage their custom certificates.

Note

Certificate Manager - SaaS supports user API tokens only. Account API tokens aren't supported.

To create a Cloudflare machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Cloudflare. To run the connector on a VSatellite, select Cloudflare (VSatellite) instead.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.
  6. If you chose Cloudflare (VSatellite), for VSatellite, choose a VSatellite that can reach Cloudflare. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. For Credential Type, choose how to provide the credentials:

    • Enter Credentials to enter the credentials in the next step. This is the default.
    • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

    Note

    Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

  8. If you chose Enter Credentials, in Cloudflare API Token, enter the API token. If you chose Select Credentials, the stored credential must hold a Cloudflare API token with the same access.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  9. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Cloudflare accepts the API token and that the token is active. It doesn't check the token's permissions or which zones it can access.

  10. (Optional) To skip certificates that have already expired, enable Exclude expired certificates.

    Discovery searches every zone the API token can access. It skips the Universal and backup certificate packs that Cloudflare manages. To read each certificate, Certificate Manager - SaaS connects to the certificate pack's hostnames on port 443, so a pack whose hostnames are all wildcards, or whose hostnames don't respond, isn't discovered.

  11. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  12. Click Continue. The Provisioning step opens.

  13. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  14. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the custom certificates in your zones.