[SSL] document backup certificate race condition known issue

[ngayerie]

Add a troubleshooting section to the backup certificates page documenting a known race condition where a backup certificate can be deleted immediately after issuance.

DEE-3829

When Universal SSL is disabled and re-enabled in quick succession, certificate processing jobs are not guaranteed to run in submission order. This can cause a newly issued backup certificate to be deleted before it becomes active. The fix documents the issue and the workaround (wait between toggling, use Advanced Certificate Manager for uninterrupted coverage).

[cloudflare-docs-bot]

Review

✅ No issues found in commit 526bce3.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

_{No code review issues found.}

Conventions

_{No convention issues found.}

Style Guide Review

_{No style-guide issues found.}

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://dee-3829-backup-cert-known-issue.previews.developers.cloudflare.com (commit 526bce3)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://a1e3c57c.previews.developers.cloudflare.com	526bce3	2026-09-08T19:23:13.181Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://6dc15f9a.previews.developers.cloudflare.com	da3b83c	2026-09-05T10:00:24.044Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://d57dde20.previews.developers.cloudflare.com	209901d	2026-09-04T11:49:41.394Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://c76637b6.previews.developers.cloudflare.com	f06e76e	2026-09-04T11:36:57.360Z	Visit the dashboard ↗
Build: In progress 🔵 View logs ↗		632c831	2026-09-04T11:27:16.801Z	View logs ↗

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
/src/content/docs/ssl/	@baubuchon-cf, @lgarofalo, @cloudflare/appsec-reviewers, @cloudflare/product-owners

[github-actions]

Preview URL: https://526bce31.preview.developers.cloudflare.com
Preview Branch URL: https://dee-3829-backup-cert-known-issue.preview.developers.cloudflare.com

Files with changes (up to 15)

Original Link	Updated Link
https://developers.cloudflare.com/ssl/edge-certificates/backup-certificates/	https://dee-3829-backup-cert-known-issue.preview.developers.cloudflare.com/ssl/edge-certificates/backup-certificates/

[baubuchon-cf]

LGTM. Verified the race condition and recovery steps against the underlying escalation — matches the confirmed root cause. ACM workaround checks out too.

[baubuchon-cf]

Can we move the TLS continuity requirement before the recovery steps? Turning off Universal SSL can cause new TLS connections to fail unless another valid certificate is already active. “Ordering” an Advanced certificate does not guarantee it is active, and Custom certificates are also supported.

Suggested text:

Before turning off Universal SSL, make sure another valid Advanced or Custom certificate is active and covers the required hostnames. Otherwise, new TLS connections will fail.

Please also confirm that “several minutes” is the validated cooldown from DEE-3829.