If your domain uses Cloudflare, you may be unable to get a free SSL certificate from us. The certificate request says Conflicting TXT records were found, even though you’ve set up the _acme-challenge CNAME record exactly as shown.
The good news: if you use Cloudflare, you don’t need our free SSL certificate at all. There are easier options that don’t require renewals and are just as secure (or close to it).
Why this happens
To issue a free SSL certificate, we need to verify that you control the domain. We do this by asking you to create a CNAME record on the _acme-challenge subdomain, pointing to a hostname we control.
Cloudflare uses the exact same _acme-challenge subdomain to obtain its own SSL certificates, which secure the connection between your visitors and Cloudflare. To do that, Cloudflare adds TXT records to that subdomain. These records are hidden: they don’t show up in your DNS settings in the Cloudflare dashboard, but they are returned to anyone who looks up the domain.
When those TXT records are present, they take precedence over your CNAME record, and our verification fails. This is a limitation of Cloudflare, and there is nothing we can do about it from our end.
Recommended: use Cloudflare’s SSL instead
Since Cloudflare already provides SSL for your visitors, all you need to secure is the connection between Cloudflare and our servers. You can do that without a certificate from us.
Option 1: Full SSL with our default certificate (easiest)
Every domain on our hosting already has a self-signed SSL certificate installed by default. Cloudflare’s Full SSL mode accepts this certificate, so the connection between Cloudflare and your website is encrypted with no setup on our end.
Follow this guide to set it up: How to setup Full SSL with Cloudflare
With this option, Cloudflare encrypts the connection to our servers but doesn’t verify that it’s actually talking to our servers. In practice, this is secure enough for almost every website.
Option 2: Full (strict) SSL with a Cloudflare Origin Certificate
If you want Cloudflare to also verify the certificate on your hosting account, you can use a Cloudflare Origin Certificate. These are free, can be valid for up to 15 years, and don’t need to be renewed every few months like our free certificates.
- Log in to the Cloudflare dashboard and select your domain.
- Go to SSL/TLS → Origin Server and click Create Certificate.
- Leave Generate private key and CSR with Cloudflare selected and choose RSA (2048) as the key type.
- Check that the hostnames list includes your domain name and the wildcard (for example,
example.comand*.example.com), then click Create. - Copy the Origin Certificate and Private Key and save them somewhere safe. Cloudflare will not show the private key again after you leave this page.
- In our members area, go to [Accounts → (your domain)→SSL Certificates→ Add SSL Certificate→ Upload Private Key and Certificate], paste the certificate and private key, and Upload. Then, install that certificate to your account.
- Back in Cloudflare, go to SSL/TLS → Overview and set the encryption mode to Full (strict).
Note: Origin Certificates are only trusted by Cloudflare. If you ever pause Cloudflare or set your DNS records to “DNS only” (grey cloud), visitors will see a certificate error. The same applies to our default self-signed certificate in Option 1.
Things that won’t fix the error
We often see people try the following, but none of these make a difference:
- Changing the SSL mode in Cloudflare. The SSL mode only controls how Cloudflare connects to our servers. It has no effect on the DNS records used for verification.
- Deleting and re-adding the CNAME record. The CNAME record is not the problem. Cloudflare’s TXT records are.
- Deleting TXT records from your Cloudflare DNS settings. The conflicting records are managed by Cloudflare and don’t appear there, so there is nothing to delete.
- Deleting and re-requesting the certificate. The new request will run into the same TXT records.
- Disabling Universal SSL in Cloudflare. Users report the hidden records can still be present even with Universal SSL turned off.
Cloudflare’s records sometimes disappear after a while, which may let a certificate request go through. However, our free certificates need to be renewed every three months, and the same problem can come back at any renewal. That’s why we recommend using one of the options above instead.