CertificatePack

Source: src/Cloudflare/Ssl/CertificatePack.ts

An Advanced Certificate Manager (ACM) certificate pack — an order for edge certificates covering a custom set of hostnames in a zone, with a choice of Certificate Authority, validation method, and validity period.

Requires the Advanced Certificate Manager subscription on the zone; ordering without it fails with the typed AdvancedCertificateManagerRequired error (Cloudflare code 1450).

Issuance is asynchronous: the resource returns as soon as the order is placed (status initializing/pending_validation) and does not wait for active, because validation may require you to create DNS records first — the outstanding records are exported as validationRecords.

The pack’s certificateAuthority, hosts, and validityDays are immutable — changing any of them replaces the pack (a new order). validationMethod and cloudflareBranding are updated in place.

Ordering a certificate pack

Order an advanced certificate for the apex and a wildcard

const pack = yield* Cloudflare.CertificatePack("ApexCert", {
  zoneId: zone.zoneId,
  certificateAuthority: "google",
  hosts: ["example.com", "*.example.com"],
  validationMethod: "txt",
  validityDays: 90,
});

Order from Let’s Encrypt with a short validity

yield* Cloudflare.CertificatePack("ShortLivedCert", {
  zoneId: zone.zoneId,
  certificateAuthority: "lets_encrypt",
  hosts: ["example.com", "api.example.com"],
  validationMethod: "http",
  validityDays: 30,
});

Completing validation

const pack = yield* Cloudflare.CertificatePack("ApexCert", {
  zoneId: zone.zoneId,
  certificateAuthority: "google",
  hosts: ["example.com"],
  validationMethod: "txt",
  validityDays: 90,
});
// pack.validationRecords contains the txtName/txtValue pairs to create
// as DNS records so the CA can validate domain control.