Skip to content

[SSL] Recommend update/renew instead of delete-and-reupload for custom certificates#31645

Open
ngayerie wants to merge 1 commit into
productionfrom
ngayerie/DEE-3624
Open

[SSL] Recommend update/renew instead of delete-and-reupload for custom certificates#31645
ngayerie wants to merge 1 commit into
productionfrom
ngayerie/DEE-3624

Conversation

@ngayerie

Copy link
Copy Markdown
Collaborator

Summary

Customers often delete and re-upload custom certificates when renewing, which causes downtime and unnecessarily consumes quota slots. The PATCH (update) path is the recommended renewal approach but was buried in the docs — error 1212 told customers to "delete some existing certificates" without acknowledging the downtime risk.

Source: SSL/TLS Clarity Report, theme 19

Changes (3 updates across 2 files)

# File Change
1 ssl/edge-certificates/custom-certificates/uploading.mdx Renamed ## Update an existing custom certificate## Update or renew an existing custom certificate and framed it as the recommended renewal path
2 ssl/edge-certificates/custom-certificates/troubleshooting.mdx Error 1212 (quota reached): point users to the update path first (dashboard, then API PATCH), add a caution about downtime when deleting active certificates
3 ssl/edge-certificates/custom-certificates/troubleshooting.mdx Error 1220 (duplicate certificate): point users to the update path instead of delete-and-reupload

Stats

2 files changed, +11 insertions, -3 deletions

Resolves DEE-3624

@github-actions

Copy link
Copy Markdown
Contributor

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern Owners
/src/content/docs/ssl/ @baubuchon-cf, @cloudflare/appsec-reviewers, @elithrar, @cloudflare/product-owners

@ask-bonk ask-bonk Bot added documentation Documentation edits content:edit Request for content edits labels Jun 23, 2026

@ask-bonk ask-bonk Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

This is a good documentation improvement. The PR correctly identifies that customers default to delete-and-reupload for custom certificate renewals, which causes downtime and wastes quota slots. Elevating the update/renew path in both the how-to page and the troubleshooting errors is the right fix.

What needs attention before merge

Broken links from heading anchor change

Renaming the heading in changes its auto-generated anchor from to .

You correctly updated the links in Error 1212 and Error 1220, but four other existing links to the old anchor will break once this merges:

File Line Link text / current anchor
67
20
18
131

Please update these four links to use .

Minor observation (non-blocking)

In (~line 201), the still instructs users to "delete and re-add the certificate" to update the Private Key Restriction setting. This is technically accurate but may feel at odds with the new guidance. Consider adding a brief caution or framing it as an exception.


Once the broken links are fixed, this is good to merge. Nice work.

@ask-bonk ask-bonk Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

This is a good documentation improvement. The PR correctly identifies that customers default to delete-and-reupload for custom certificate renewals, which causes downtime and wastes quota slots. Elevating the update/renew path in both the how-to page and the troubleshooting errors is the right fix.

What needs attention before merge

Broken links from heading anchor change

Renaming the ## Update an existing custom certificate heading in uploading.mdx changes its auto-generated anchor from #update-an-existing-custom-certificate to #update-or-renew-an-existing-custom-certificate.

You correctly updated the links in Error 1212 and Error 1220, but four other existing links to the old anchor will break once this merges:

File Line Link text / current anchor
src/content/docs/ssl/edge-certificates/custom-certificates/troubleshooting.mdx 67 [update your custom certificate](/.../#update-an-existing-custom-certificate)
src/content/docs/ssl/edge-certificates/custom-certificates/index.mdx 20 [Update the certificate](/.../#update-an-existing-custom-certificate)
src/content/docs/ssl/edge-certificates/custom-certificates/renewing.mdx 18 [update](/.../#update-an-existing-custom-certificate)
src/content/docs/ssl/reference/certificate-rotation.mdx 131 [Manage custom certificates](/.../#update-an-existing-custom-certificate)

Please update these four links to use #update-or-renew-an-existing-custom-certificate.

Minor observation (non-blocking)

In uploading.mdx (~line 201), the :::note still instructs users to "delete and re-add the certificate" to update the Private Key Restriction setting. This is technically accurate but may feel at odds with the new guidance. Consider adding a brief caution or framing it as an exception.


Once the broken links are fixed, this is good to merge. Nice work.

@ask-bonk

ask-bonk Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

I've reviewed PR #31645 and posted a review requesting changes. Here's what I found:

Summary of changes
The PR elevates the update/renew path for custom certificates over the harmful delete-and-reupload pattern. It renames the "Update an existing custom certificate" heading in uploading.mdx and updates Error 1212 (quota reached) and Error 1220 (duplicate certificate) in troubleshooting.mdx to point users toward the PATCH/dashboard update flow, adding a caution callout about downtime when deleting active certificates. This is a solid documentation improvement.

Issue flagged — broken internal links
Renaming the heading changes its auto-generated anchor from #update-an-existing-custom-certificate to #update-or-renew-an-existing-custom-certificate. The PR correctly updates the two links inside the error sections it changes, but four other existing links to the old anchor will break once this merges:

File Line
ssl/edge-certificates/custom-certificates/troubleshooting.mdx 67 (Let's Encrypt section)
ssl/edge-certificates/custom-certificates/index.mdx 20
ssl/edge-certificates/custom-certificates/renewing.mdx 18
ssl/reference/certificate-rotation.mdx 131

I suggested updating all four to #update-or-renew-an-existing-custom-certificate.

Minor observation
In uploading.mdx (~line 201), a :::note still tells users they must delete and re-add a certificate to update the Private Key Restriction setting. I flagged this as a non-blocking suggestion to add a brief caution since it conflicts slightly with the new anti-deletion messaging.

Labels applied

  • documentation
  • content:edit

(The PR already had product:ssl and size/s.)


Note: A duplicate empty review comment briefly appeared due to shell escaping on my first command attempt. The complete review is posted correctly and actionable.

github run

…ificates

Customers often delete and re-upload custom certificates when renewing,
which causes downtime and unnecessarily consumes quota slots. The PATCH
(update) path is the recommended renewal approach but was buried in docs.

- Rename 'Update an existing custom certificate' to 'Update or renew an
  existing custom certificate' and frame it as the recommended renewal path
- Error 1212 (quota): point users to update path first, warn about
  downtime when deleting active certificates
- Error 1220 (duplicate): point users to update path instead of delete

Resolves DEE-3624
@ngayerie ngayerie force-pushed the ngayerie/DEE-3624 branch from 8cbca18 to 074da75 Compare June 23, 2026 12:07
@ngayerie ngayerie marked this pull request as ready for review June 23, 2026 12:37
@ngayerie ngayerie requested review from a team, baubuchon-cf and elithrar as code owners June 23, 2026 12:37
@cloudflare-docs-bot

cloudflare-docs-bot Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Review

⚠️ 2 warnings found in commit 074da75.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

✅ No code review issues found.

Style Guide Review

Warnings (2)
File Issue
ssl/edge-certificates/custom-certificates/uploading.mdx line 171 Directional words — Added line uses follow the steps below Fix: Replace below with a direct reference by name or link, e.g., follow these steps or link to the steps section.
ssl/edge-certificates/custom-certificates/uploading.mdx line 201 Directional words — Added line uses recommended renewal flow above Fix: Remove above and refer directly to the recommended renewal flow by name or link.
Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command Description
/review Runs a review now. Incremental if a prior review exists, full if not.
/full-review Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.

@ngayerie ngayerie changed the title Recommend update/renew instead of delete-and-reupload for custom certificates [SSL] Recommend update/renew instead of delete-and-reupload for custom certificates Jun 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

content:edit Request for content edits documentation Documentation edits product:ssl Related to SSL size/s

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants