Refer to the following sections to learn how to manage certificates used with the different Authenticated Origin Pulls setups.

## Use specialized certificates

To apply different client certificates simultaneously at both the zone and hostname level, you can combine zone-level and per-hostname custom certificates.

First set up [zone-level pulls](https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull/set-up/zone-level/) using a certificate. Then, upload multiple, specialized certificates for [individual hostnames](https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull/set-up/per-hostname/).

Note

Since per-hostname certificates are more specific, they take precedence over zone certificates.

## Delete a certificate

Client certificates are not deleted from Cloudflare upon expiration unless a [delete](https://developers.cloudflare.com/api/resources/origin_tls_client_auth/methods/delete/) or [replace](https://developers.cloudflare.com/api/resources/origin_tls_client_auth/methods/create/) request is sent to the Cloudflare API.

However, requests are dropped at your origin if your origin only accepts a valid client certificate.

## Replace a client cert (without downtime)

For hostname:

1. [Upload the new certificate](https://developers.cloudflare.com/api/resources/origin_tls_client_auth/subresources/hostnames/subresources/certificates/methods/create/).

2. [Enable Authenticated Origin Pulls for that specific hostname](https://developers.cloudflare.com/api/resources/origin_tls_client_auth/subresources/hostnames/methods/update/).

For global:

1. [Upload the new certificate](https://developers.cloudflare.com/api/resources/origin_tls_client_auth/methods/create/).

2. [Check whether new certificate is Active](https://developers.cloudflare.com/api/resources/origin_tls_client_auth/methods/get/).

3. Once certificate is active, [delete the previous certificate](https://developers.cloudflare.com/api/resources/origin_tls_client_auth/methods/delete/).
