Cloudflare is the most popular DNS provider for the kind of teams that run sGTM, and the default Cloudflare settings will break SSL on your tagging server in subtle ways. The fix is six clicks once you know which ones.

Step 1: add the CNAME

In Cloudflare, DNS > Add Record. Type: CNAME. Name: your subdomain (e.g., data). Target: the tagging URL from your SprTags dashboard. Save.

Step 2: set proxy status to DNS only

By default Cloudflare turns on proxy (orange cloud) for new records. For your tagging URL, this breaks the SSL handshake because Cloudflare and the upstream both want to terminate SSL. Click the orange cloud to turn it grey (DNS only).

SprTags handles its own SSL provisioning. Cloudflare in proxy mode interferes with that. The grey cloud lets DNS resolve normally without Cloudflare intercepting.

Step 3: wait for DNS propagation

Cloudflare's DNS is fast but not instantaneous. Wait 60-120 seconds. Verify with:

dig data.example.com +short

Should return an IP. If it returns nothing, wait another minute and try again.

Step 4: trigger SSL provisioning

In your SprTags dashboard, find the container and click "Verify domain." This tells SprTags to begin Let's Encrypt provisioning for your hostname. Provisioning takes 1-15 minutes typically.

Step 5: verify the certificate

echo | openssl s_client -servername data.example.com -connect data.example.com:443 2>/dev/null | openssl x509 -noout -issuer

Issuer should be Let's Encrypt or Google Trust Services. If you see "self-signed" or "unknown CA," provisioning is not complete. Wait or check the dashboard for errors.

Step 6: test from a browser

Open https://data.example.com in your browser. Should show a 404 from gtm.js (which is normal; the path is wrong but the SSL handshake completes). Should not show a certificate warning.

If you see a certificate warning in Cloudflare, the most common cause is that proxy mode is still on. Double-check the cloud is grey. If still failing, check Cloudflare's SSL/TLS encryption mode is set to "Full" or "Full (strict)," not "Off" or "Flexible."

Cloudflare-specific gotchas

• Cloudflare's "Always Use HTTPS" page rule can interfere with the cert provisioning challenge. Disable for the verification window if needed.
• Cloudflare's WAF can rate-limit Let's Encrypt's validation requests. Whitelist Let's Encrypt IPs if you have aggressive WAF settings.
• If you have Cloudflare Access on your domain, exempt the tagging subdomain explicitly.

For non-Cloudflare DNS providers, the general custom domain walkthrough applies.