As of March 2026, this method has stopped working as Cloudflare have stopped issuing ip6.arpa certificates.

ARPA domains are used for reverse DNS. And, while it is unusual you actually can host a website on a reverse DNS domain (see this website). However, most Certificate Authorities (CAs) won’t issue certificates for ARPA domains, so how do we get one?

For starters, the common CAs won’t issue certificates for ARPA domains. Let’s Encrypt called the practice an “RFC 3172 violation” and closed the Github issue, Sectigo and GTS also rejected the requests outright.

However, I found SSL.com will issue certificates for ARPA domains. But, it’ll cost around $50/year directly from them. The good news is you can get an SSL.com certificate for free using Cloudflare.

However, Cloudflare’s default issuer is GTS which will reject us. This is where we need to use a little trick to switch to SSL.com, which will issue the certificate. After consulting with the documentation, I found how to change a zone’s issuer. The process is fairly straightforward. You’ll need your Cloudflare Global API Key and Zone ID. Then, run the following command in your terminal:

curl -X PATCH \
  "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/ssl/universal/settings" \
  -H "X-Auth-Email: ${EMAIL}" \
  -H "X-Auth-Key: ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true,"certificate_authority":"ssl_com"}'

Make sure to replace:

  • ${EMAIL} with your Cloudflare account email (this must be the email you used to create the Cloudflare account)
  • ${API_KEY} with your Global API Key (you can find this in the Cloudflare dashboard here)
  • ${ZONE_ID} with your Cloudflare Zone ID (which you can find in the Cloudflare dashboard, see below)

Cloudflare Zone ID Location

After running the command, you should see the certificate waiting for TXT verification on the page. If you don’t see this, try disabling “Universal SSL” and then run the command again to re-enable it.

Cloudflare Zone ID Location

Ensure the ‘Proxy’ mode is on in the DNS settings, set up your origin, and you should be good to go.

So in the end, we now have a TLS certificate, at the cost of … well … not actually being able to download it since Cloudflare won’t let you.