Universal SSL
By default, Cloudflare issues — and renews — free, unshared, publicly trusted SSL certificates to all Cloudflare domains.
For setup details, refer to Enable Universal SSL
.
Backup certificates
Depending on your plan, Cloudflare may issue a backup Universal certificate automatically for your domain.
Backup certificates are wrapped with a different private key and issued from a different Certificate Authority — either Google Trust Services or Sectigo — than the primary certificate.
For additional details, refer to the introductory blog post.