Certificate for CloudFlare Origin Certificate Issued to CloudFlare, Inc.

Certificate is witin its validity period

Issued by CloudFlare, Inc.

About the CloudFlare Origin Certificate Certificate

This certificate with serial number 20:56:23:05:2d:3e:48:f3:8f:69:69:d4:b8:4f:69:8c:81:66:d9:c4 for CloudFlare Origin Certificate was issued on by CloudFlare, Inc..

With 2 subject alternative names, this certificate can be used to secure multiple FQDNs. This Certificate is currently within its validity period but we haven't checked the revocation status of this certificate, you can do this simply on revocationcheck.com. We have found some issues with the compliance of this certificate, they are be shown below. We hope this Certificate review for CloudFlare Origin Certificate provides you with the detailed information you were looking for.


We have identified some issues with this certificate:
  • Characters in labels of DNSNames MUST be alphanumeric, - , _ or * (BRs: 7.1.4.2)
  • DNSNames must have a valid TLD. (BRs: 3.2.2.4)
  • OrganizationalUnitName is prohibited if...the certificate was issued on or after September 1, 2022 (BRs: 7.1.4.2.2-i)
  • Subscriber certificates must contain at least one policy identifier that indicates adherence to CAB standards (BRs: 7.1.2.3)
  • Subscriber Certificate: certificatePolicies MUST be present and SHOULD NOT be marked critical. (BRs: 7.1.2.3)
  • Subscriber Certificate: subject:countryName MUST appear if the subject:organizationName field, subject:givenName field, or subject:surname fields are present. (BRs: 7.1.4.2.2)
  • Subscriber Certificate: subject:localityName MUST appear if subject:organizationName, subject:givenName, or subject:surname fields are present but the subject:stateOrProvinceName field is absent. (BRs: 7.1.4.2.2)
  • Subscriber Certificate: subject:stateOrProvinceName MUST appear if the subject:organizationName, subject:givenName, or subject:surname fields are present and subject:localityName is absent. (BRs: 7.1.4.2.2)
  • Subscriber Certificates issued after 1 July 2016 but prior to 1 March 2018 MUST have a Validity Period no greater than 39 months. (BRs: 6.3.2)
  • Subscriber Certificates issued after 1 March 2018, but prior to 1 September 2020, MUST NOT have a Validity Period greater than 825 days. (BRs: 6.3.2)
  • Missing common name, 'CloudFlare Origin Certificate' The common name field in subscriber certificates must include only names from the SAN extension (BRs: 7.1.4.2.2)
  • TLS server certificates issued on or after September 1, 2020 00:00 GMT/UTC must not have a validity period greater than 398 days (https://support.apple.com/en-us/HT211025)
  • Certificate had 0 embedded SCTs. Browser policy may require 5 for this certificate. Check if certificate has enough embedded SCTs to meet Apple CT Policy (https://support.apple.com/en-us/HT205280)
  • Subscriber certificates use of Subject Key Identifier is NOT RECOMMENDED (BRs v2: 7.1.2.7.6)
  • Subscriber certificates authorityInformationAccess extension should contain the HTTP URL of the issuing CA’s certificate (BRs: 7.1.2.3)
  • Subscriber Certificate: commonName is NOT RECOMMENDED. (BRs: 7.1.2.7.1)
  • Apple recommends that certificates be issued with a maximum validity of 397 days. TLS server certificates issued on or after September 1, 2020 00:00 GMT/UTC should not have a validity period greater than 397 days (https://support.apple.com/en-us/HT211025)

CloudFlare, Inc.

Organization: CloudFlare, Inc.
Organizational unit: CloudFlare Origin SSL Certificate Authority
State / Province: California
Locality: San Francisco
Country: US

This X.509 certificate will expire on

Certificate Details

Serial Number (hex): 20:56:23:05:2d:3e:48:f3:8f:69:69:d4:b8:4f:69:8c:81:66:d9:c4
Serial Number (int): 184608619444994606424826745882466805975307704772
Serial Number Length: 158 bits, 20 octets

Subject Key Identifier: 83:8f:66:39:ec:94:b2:07:8f:34:de:40:e3:3b:62:b1:fc:10:14:29
Authority Key Identifier: 24:e8:53:57:5d:7c:34:40:87:a9:eb:94:db:ba:e1:16:78:fc:29:a4

Fingerprint (SHA-1): 02:fa:a2:d8:b8:a6:dd:4b:e6:4e:80:c4:8b:d3:11:f1:65:b5:5e:ea
Fingerprint (SHA-256): 7c:f7:88:da:e8:d5:9e:31:1e:87:98:bc:f2:bb:dc:05:18:7c:c6:03:64:1e:4f:37:2e:5a:f8:84:7f:6d:1a:b1


Revocation Information

OCSP Server: http://ocsp.cloudflare.com/origin_ca
CRL Distribution Point: http://crl.cloudflare.com/origin_ca.crl

Check the revocation status for certificate CloudFlare Origin Certificate
2
DNS Names
0
Email Addresses
0
IP Addresses

Advanced Certificate Properties

Technical details of the X.509 certificate for CloudFlare Origin Certificate

Public Key Algorithm
RSA
Key Size
2048
Signature Algorithm
SHA256 with RSA
Key Usage
Digital Signature
Key Encipherment
Extended Key Usages
Client Authentication
Server Authentication
Extensions
8
CA Certificate
This is not a CA certificate

Subject Alternative Names

X.509 Certificate

The complete raw X.509 certificate details for CloudFlare Origin Certificate in PEM and ASN.1 format.

Certificate (PEM)

-----BEGIN CERTIFICATE-----
MIIEpDCCA4ygAwIBAgIUIFYjBS0+SPOPaWnUuE9pjIFm2cQwDQYJKoZIhvcNAQEL
BQAwgYsxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTQw
MgYDVQQLEytDbG91ZEZsYXJlIE9yaWdpbiBTU0wgQ2VydGlmaWNhdGUgQXV0aG9y
aXR5MRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MB4XDTI0MTIyMzE2MjUwMFoXDTM5MTIyMDE2MjUwMFowYjEZMBcGA1UEChMQQ2xv
dWRGbGFyZSwgSW5jLjEdMBsGA1UECxMUQ2xvdWRGbGFyZSBPcmlnaW4gQ0ExJjAk
BgNVBAMTHUNsb3VkRmxhcmUgT3JpZ2luIENlcnRpZmljYXRlMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmd7DeL8BS+V6ofluDHFx+vGGdpSwwux8Ba0X
8m3E0WeQdYbnyTqJkWPpJ7w63q/vdwQ4PKIMudN0kl1cueEm4byzM6KrtLjgIHtN
D6H22L2ZPUFVF0bExy2vLtSr4hAr8UpQgmHCA7QFNsNtrDNHWOt51Op3EFAlMktC
vanpFAgMboxICR2PZfE2WcfmDF4iUZVXPQrCg+FglrDGXEnQUNqoI9bKsCFZgghu
XjGxNcjn/uPO6TdZD0adf/S3SoKzwFF5NUA9X0e3xcwqOfNyu1qS6ESh+EDJVWnv
tPFA/WQz2HU6WxR/jyKLSu2QNMgBiyFDZoStsW25z1ay8TaiHQIDAQABo4IBJjCC
ASIwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
ATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSDj2Y57JSyB4803kDjO2Kx/BAUKTAf
BgNVHSMEGDAWgBQk6FNXXXw0QIep65TbuuEWePwppDBABggrBgEFBQcBAQQ0MDIw
MAYIKwYBBQUHMAGGJGh0dHA6Ly9vY3NwLmNsb3VkZmxhcmUuY29tL29yaWdpbl9j
YTAnBgNVHREEIDAegg4qLmNhcHN0YWdlLm5ldIIMY2Fwc3RhZ2UubmV0MDgGA1Ud
HwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuY2xvdWRmbGFyZS5jb20vb3JpZ2luX2Nh
LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAc21hlVJzKWVElboNTPJ3efCD6rZKTF/t
4Ie8WlLnrk0QbE4BdfcgKGg3ro/hh8C0JE4+p4Qvu6ZSQf9ItQvj0kyvDtxxslJ/
2S+JReWI9LdCeBeJw+gCit8Z+wP6jf3b3HNt7LLmU37Eezk0OLMnr7mszarNZi8V
AGJGU0GnwiqkwZLf4k+G5lJZVjt+zb9plzNlfAmzkFdkwgrNPRtFEDIuz4Qezc2k
AG8dwCqgXNgEPnowGrYd2T8nuHKSsMlQuHMSCK+CV4tp1TRMmiiTw3Ow+5t2MmDK
gpxo2s7YSBiUPZOGdMAUtFAkIaHQI1LIHdxmfV/j0fFMN6EiWIjT1g==
-----END CERTIFICATE-----

Public Key (PEM)

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmd7DeL8BS+V6ofluDHFx
+vGGdpSwwux8Ba0X8m3E0WeQdYbnyTqJkWPpJ7w63q/vdwQ4PKIMudN0kl1cueEm
4byzM6KrtLjgIHtND6H22L2ZPUFVF0bExy2vLtSr4hAr8UpQgmHCA7QFNsNtrDNH
WOt51Op3EFAlMktCvanpFAgMboxICR2PZfE2WcfmDF4iUZVXPQrCg+FglrDGXEnQ
UNqoI9bKsCFZgghuXjGxNcjn/uPO6TdZD0adf/S3SoKzwFF5NUA9X0e3xcwqOfNy
u1qS6ESh+EDJVWnvtPFA/WQz2HU6WxR/jyKLSu2QNMgBiyFDZoStsW25z1ay8Tai
HQIDAQAB
-----END PUBLIC KEY-----

ASN.1 Decoded

 [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . [c:2|t:0|true] OtherName 
 . . . . . . . . . . . . [c:0|t:2|false] INTEGER 2
 . . . . . . . . [c:0|t:2|false] INTEGER 184608619444994606424826745882466805975307704772
 . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 1.2.840.113549.1.1.11
 . . . . . . . . . . . . [c:0|t:5|false] NULL []
 . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . [c:0|t:17|true] SET, SET OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.4.6
 . . . . . . . . . . . . . . . . . . . . [c:0|t:19|false] PrintableString 'US'
 . . . . . . . . . . . . [c:0|t:17|true] SET, SET OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.4.10
 . . . . . . . . . . . . . . . . . . . . [c:0|t:19|false] PrintableString 'CloudFlare, Inc.'
 . . . . . . . . . . . . [c:0|t:17|true] SET, SET OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.4.11
 . . . . . . . . . . . . . . . . . . . . [c:0|t:19|false] PrintableString 'CloudFlare Origin SSL Certificate Authority'
 . . . . . . . . . . . . [c:0|t:17|true] SET, SET OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.4.7
 . . . . . . . . . . . . . . . . . . . . [c:0|t:19|false] PrintableString 'San Francisco'
 . . . . . . . . . . . . [c:0|t:17|true] SET, SET OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.4.8
 . . . . . . . . . . . . . . . . . . . . [c:0|t:19|false] PrintableString 'California'
 . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . [c:0|t:23|false] UTCTime 2024-12-23 16:25:00 +0000 UTC
 . . . . . . . . . . . . [c:0|t:23|false] UTCTime 2039-12-20 16:25:00 +0000 UTC
 . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . [c:0|t:17|true] SET, SET OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.4.10
 . . . . . . . . . . . . . . . . . . . . [c:0|t:19|false] PrintableString 'CloudFlare, Inc.'
 . . . . . . . . . . . . [c:0|t:17|true] SET, SET OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.4.11
 . . . . . . . . . . . . . . . . . . . . [c:0|t:19|false] PrintableString 'CloudFlare Origin CA'
 . . . . . . . . . . . . [c:0|t:17|true] SET, SET OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.4.3
 . . . . . . . . . . . . . . . . . . . . [c:0|t:19|false] PrintableString 'CloudFlare Origin Certificate'
 . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 1.2.840.113549.1.1.1
 . . . . . . . . . . . . . . . . [c:0|t:5|false] NULL []
 . . . . . . . . . . . . [c:0|t:3|false] BIT STRING (2160 bits)
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:2|false] INTEGER 19424309465950572317613182419370011717487584630829745233435908506077739516073260198533443476139585477625473803352980276298207557870204890469116966045662058239482679253868736984096780425249826002780473107076139860738811760310883772713736837843554112210751318139856060041787387294743170642555798784229453593230079823433552257153644703557617053307752440843775346180642602871570128237644803073087368053388324414205871400221197678759550355210830146966630799589983095872009580803227995243891469324030200812496588062749811471690418012041474655931989504715912545208166466756409073189343538368903001055698311675496922885825053
 . . . . . . . . . . . . . . . . . . . . [c:0|t:2|false] INTEGER 65537

 . . . . . . . . [c:2|t:3|true] ORAddress 
 . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.29.15
 . . . . . . . . . . . . . . . . . . . . [c:0|t:1|false] BOOLEAN true
 . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (4 bytes)
 . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:3|false] BIT STRING (3 bits)
							05a0
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.29.37
 . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (22 bytes)
 . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 1.3.6.1.5.5.7.3.2
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 1.3.6.1.5.5.7.3.1
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.29.19
 . . . . . . . . . . . . . . . . . . . . [c:0|t:1|false] BOOLEAN true
 . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (2 bytes)
 . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.29.14
 . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (22 bytes)
 . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (20 bytes)
							838f6639ec94b2078f34de40e33b62b1fc101429
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.29.35
 . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (24 bytes)
 . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:2|t:0|false] OtherName 24e853575d7c344087a9eb94dbbae11678fc29a4
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 1.3.6.1.5.5.7.1.1
 . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (52 bytes)
 . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 1.3.6.1.5.5.7.48.1
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:2|t:6|false] IA5String 'http://ocsp.cloudflare.com/origin_ca'
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.29.17
 . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (32 bytes)
 . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:2|t:2|false] IA5String '*.capstage.net'
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:2|t:2|false] IA5String 'capstage.net'
 . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 2.5.29.31
 . . . . . . . . . . . . . . . . . . . . [c:0|t:4|false] OCTET STRING (49 bytes)
 . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:2|t:0|true] OtherName 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:2|t:0|true] OtherName 
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [c:2|t:6|false] IA5String 'http://crl.cloudflare.com/origin_ca.crl'
 . . . . [c:0|t:16|true] SEQUENCE, SEQUENCE OF 
 . . . . . . . . [c:0|t:6|false] OBJECT IDENTIFIER 1.2.840.113549.1.1.11
 . . . . . . . . [c:0|t:5|false] NULL []
 . . . . [c:0|t:3|false] BIT STRING (2048 bits)
		00736d6195527329654495ba0d4cf27779f083eab64a4c5fede087bc5a52e7ae4d106c4e0175f720286837ae8fe187c0b4244e3ea7842fbba65241ff48b50be3d24caf0edc71b2527fd92f8945e588f4b742781789c3e8028adf19fb03fa8dfddbdc736decb2e6537ec47b393438b327afb9accdaacd662f150062465341a7c22aa4c192dfe24f86e65259563b7ecdbf699733657c09b3905764c20acd3d1b4510322ecf841ecdcda4006f1dc02aa05cd8043e7a301ab61dd93f27b87292b0c950b8731208af82578b69d5344c9a2893c373b0fb9b763260ca829c68daced84818943d938674c014b4502421a1d02352c81ddc667d5fe3d1f14c37a1225888d3d6