diff --git a/docs/deploying_clearml/clearml_server_config.md b/docs/deploying_clearml/clearml_server_config.md
index 760eb602..692e1e94 100644
--- a/docs/deploying_clearml/clearml_server_config.md
+++ b/docs/deploying_clearml/clearml_server_config.md
@@ -57,6 +57,10 @@ For example, a domain is called `mydomain.com`, and a subdomain named `clearml.m
 
 Accessing the [ClearML Web UI](../webapp/webapp_overview.md) with `app.clearml.mydomain.com` will automatically send API requests to `api.clearml.mydomain.com`.
 
+:::note
+If using Cloudflare Tunnels as a reverse proxy, create three tunnels, one for each respective service. Importantly, the SSL certs (in the free tier) will only be valid for one level of subdomain, so instead use `app.mydomain.com`, `api.mydomain.com`, and `files.mydomain.com` in order to avoid [version-cipher-mismatch errors](https://developers.cloudflare.com/ssl/troubleshooting/version-cipher-mismatch/#multi-level-subdomains).
+:::
+
 ## ClearML Server Feature Configurations
 
 ClearML Server features can be configured using either configuration files or environment variables.
@@ -435,4 +439,4 @@ The custom action is always performed from a context-menu opened from a specific
 When clicking the custom action, the UI sends the target endpoint (`url`) the appropriate request, injecting the template 
 with the object's ID.
 
-The UI will display a toast message conveying action success or failure.
\ No newline at end of file
+The UI will display a toast message conveying action success or failure.