セットアップ

Cloudflare for SaaSをapexプロキシのために設定するには、通常のセットアップとは異なり、以下の手順を実行します。

---

Before you begin

Before you start creating custom hostnames:

1. Add your zone to Cloudflare (これはあなたのIPプレフィックスに関連付けられたアカウント内である必要があります。)
2. Enable Cloudflare for SaaS for your zone.
3. Review the Hostname prioritization guidelines. Wildcard custom hostnames behave differently than an exact hostname match.
4. (optional) Review the following documentation:

• API documentation (if you have not worked with the Cloudflare API before).
• Certificate validation.

---

初期設定

When you first enable Cloudflare for SaaS, you need to perform a few steps prior to creating any custom hostnames.

ステップ1 - IP範囲を取得

apexプロキシを使用する場合、自分のIP範囲を持ち込むか、Cloudflareが提供するIPアドレスのセットを使用できます。

このステップの詳細については、アカウントチームにお問い合わせください。

注意

これらのIPアドレスは、あなたのCloudflareゾーンに関連付けられたものとは異なります。

ステップ2 - フォールバックオリジンを作成

The fallback origin is where Cloudflare will route traffic sent to your custom hostnames (must be proxied).

ノート

If you are an Enterprise customer, you can route custom hostnames to distinct origins by using custom origin server.

To create your fallback origin:

1. Create a proxied A, AAAA, or CNAME record pointing to the IP address of your fallback origin (where Cloudflare will send custom hostname traffic).

Type	Name	IPv4 address	Proxy status
A	proxy-fallback	192.0.2.1	Proxied

2. Designate that record as your fallback origin.

Dashboard

1. Log into the Cloudflare dashboard ↗.
2. Select your account and zone.
3. Go to SSL/TLS > Custom Hostnames.
4. For Fallback Origin, enter the hostname for your fallback origin.
5. Select Add Fallback Origin.

API

Using the hostname of the record you just created, update the fallback origin value.

3. Once you have added the fallback origin, confirm that its status is Active.

ノート

When Cloudflare marks your fallback origin as Active, that only reflects that we are ready to send traffic to that DNS record.

You need to make sure your DNS record is sending traffic to the correct origin location.

---

ホスト名ごとの設定

You need to perform the following steps for each custom hostname.

Step 1 — Plan for validation

Before you create a hostname, you need to plan for:

1. Certificate validation: Upon successful validation, the certificates are deployed to Cloudflare’s global network.
2. Hostname validation: Upon successful validation, Cloudflare proxies traffic for this hostname.

You must complete both these steps for the hostname to work as expected.

Important

Depending on which method you select for each of these options, additional steps might be required for you and your customers.

Step 2 — Create custom hostname

After planning for certification and hostname validation, you can create the custom hostname.

To create a custom hostname:

Dashboard

1. Log in to the Cloudflare dashboard ↗ and select your account.
2. Select your Cloudflare for SaaS application.
3. Navigate to SSL/TLS > Custom Hostnames.
4. Click Add Custom Hostname.
5. Add your customer’s hostname app.customer.com and set the relevant options, including:
   • Choosing the Validation method.
   • Whether you want to Enable wildcard, which adds a *.<custom-hostname> SAN to the custom hostname certificate. For more details, refer to Hostname priority.
   • Choosing a value for Custom origin server.
6. Click Add Custom Hostname.

Default behavior

When you create a custom hostname:

• If you issue a custom hostname certificate with wildcards enabled, you cannot customize TLS settings for these wildcard hostnames.
• If you do not specify the Minimum TLS Version, it defaults to 1.0, not the zone’s Minimum TLS Version. You can still edit this setting after creation.

API

1. To create a custom hostname using the API, use the Create Custom Hostname endpoint.

   • You can leave the certificate_authority parameter empty to set it to “default CA”. With this option, Cloudflare checks the CAA records before requesting the certificates, which helps ensure the certificates can be issued from the CA.

2. For the newly created custom hostname, the POST response may not return the DCV validation token validation_records. It is recommended to make a second GET command (with a delay) to retrieve these details.

The response contains the complete definition of the new custom hostname.

Default behavior

When you create a custom hostname:

• If you issue a custom hostname certificate with wildcards enabled, you cannot customize TLS settings for these wildcard hostnames.
• If you do not specify the Minimum TLS Version, it defaults to 1.0, not the zone’s Minimum TLS Version. You can still edit this setting after creation.

ノート

For each custom hostname, Cloudflare issues two certificates bundled in chains that maximize browser compatibility (unless you upload custom certificates).

The primary certificate uses a P-256 key, is SHA-2/ECDSA signed, and will be presented to browsers that support elliptic curve cryptography (ECC). The secondary or fallback certificate uses an RSA 2048-bit key, is SHA-2/RSA signed, and will be presented to browsers that do not support ECC.

ステップ3 - 顧客にDNSレコードを作成させる

カスタムホスト名の設定を完了するために、顧客はその権威DNSプロバイダーでAまたはCNAMEレコードを設定できます。

ノート

顧客がCNAMEレコードを使用できるようにするには、通常のセットアッププロセスも完了する必要があります。

Aレコード

顧客がその権威DNSプロバイダーでAレコードを使用する場合、ホスト名をあなたのアカウントに割り当てられたIPプレフィックスにポイントする必要があります。

注意

Before your customer does this step, confirm that the hostname’s Certificate status and Hostname status are both Active.

If not, confirm that you are using a method of certificate or hostnames validation that occurs after your customer adds their DNS record.

顧客のAレコードは以下のようになります：

example.com.  60  IN  A   192.0.2.1

CNAMEレコード

顧客がその権威DNSでCNAMEレコードを使用する場合、ホスト名をあなたのCNAMEターゲット ¹にポイントする必要があります。

注意

Before your customer does this step, confirm that the hostname’s Certificate status and Hostname status are both Active.

If not, confirm that you are using a method of certificate or hostnames validation that occurs after your customer adds their DNS record.

顧客のCNAMEレコードは以下のようになります：

mystore.com CNAME customers.saasprovider.com

サービスの継続

If your customer is also using Cloudflare for their domain, they should keep their DNS record pointing to your SaaS provider in place for as long as they want to use your service.

For more details, refer to Remove custom hostnames.

Footnotes

1. If you have regional services set up for your custom hostnames, Cloudflare always uses the processing region associated with your DNS target record (instead of the processing region of any custom origins).

   ↩