---
title: CDN Wildcard Domains
url: "/docs/domains/wildcard-cdn/"
canonical_url: https://docs.blossom88.com/docs/domains/wildcard-cdn/
markdown_url: https://docs.blossom88.com/docs/domains/wildcard-cdn.md
summary: Configure wildcard domains with SSL termination at the CDN level for Cloudflare,
  CloudFront, and Akamai
categories:
- domains
- networking
- ssl
- cdn
- configuration
---

# CDN Wildcard Domains

When using a CDN (Content Delivery Network) with wildcard Domains, public
SSL/TLS termination happens at the CDN rather than at the Blossom origin. This
guide explains how to configure that relationship.

> **Note**: If you want Blossom to handle wildcard TLS directly, see
> [Direct Wildcard Domains](/docs/domains/wildcard-direct/).

## Overview

With CDN-based SSL termination:

- Your CDN handles the SSL certificate for `*.example.com`
- Traffic between users and the CDN is encrypted
- Traffic between the CDN and the Blossom origin uses the selected origin mode

## CDN Provider Configuration

### Cloudflare





<aside class="docs-callout not-typography" data-tone="info">
  
  <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke="currentColor" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"></path></svg>
  
  <div class="docs-callout-body">
    
    <div class="info-content">
      
<p>For basic Cloudflare setup instructions, see our <a href="/docs/cdn/cloudflare/">Cloudflare Setup Guide</a>.</p>

    </div>
  </div>
</aside>


1. Add your domain to Cloudflare
2. Create a wildcard DNS record (`*.example.com`) using the origin target Blossom displays
3. In Blossom, configure the domain with:
   - Mode: **HTTP Only** for Flexible SSL
   - Mode: **Self-signed SSL** for Full SSL

### AWS CloudFront





<aside class="docs-callout not-typography" data-tone="info">
  
  <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke="currentColor" aria-hidden="true"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"></path></svg>
  
  <div class="docs-callout-body">
    
    <div class="info-content">
      
<p>For basic CloudFront setup instructions, see our <a href="/docs/cdn/cloudfront/">CloudFront Setup Guide</a>.</p>

    </div>
  </div>
</aside>


1. Request a wildcard certificate in AWS Certificate Manager
2. Create a CloudFront distribution
3. Configure the wildcard domain as an alternate domain name
4. Point the distribution to the origin target Blossom displays
5. In Blossom, configure the domain with:
   - Mode: **HTTP Only** (CloudFront doesn't support self-signed certificates)

> **Note**: With CloudFront, even though we configure HTTP Only mode in Blossom, the traffic is still encrypted. Here's how it works:
>
> - Your origin (e.g., `origin.example.com`) can use HTTPS
> - Your CloudFront distribution handles `*.example.com` and `www.example.com`
> - CloudFront passes the Host header through to your origin
> - The traffic between CloudFront and your origin remains encrypted via `https://origin.example.com`

### Akamai

1. Configure your wildcard certificate in Akamai
2. Create a property for your domain
3. Configure origin settings with the target Blossom displays
4. In Blossom, configure the domain with:
   - Mode: **Self-signed SSL** or **HTTP Only** depending on your Akamai configuration

## SSL Modes Explained

### HTTP Only Mode

- Use when your CDN doesn't support self-signed certificates
- Traffic between CDN and Blossom is unencrypted
- Example: CloudFront, Cloudflare Flexible SSL

### Self-signed SSL Mode

- Use when your CDN supports self-signed certificates for origin
- Provides end-to-end encryption
- Example: Cloudflare Full SSL, Akamai with custom certificates

## Important Notes

- The CDN handles the public SSL certificate for your wildcard domain
- Your CDN's DNS must point to the origin target Blossom displays
- Certificate renewal is handled by your CDN, not by Blossom

## Troubleshooting

If you encounter issues:

1. Verify your CDN's DNS configuration
2. Check your CDN's SSL/TLS configuration
3. Confirm the correct SSL mode is selected in Blossom
4. Check Environment logs and Domain Activity for origin connection issues