diff --git a/internal/services/universal_ssl_setting/resource.go b/internal/services/universal_ssl_setting/resource.go
index c3335a5966..fa10a7ff64 100644
--- a/internal/services/universal_ssl_setting/resource.go
+++ b/internal/services/universal_ssl_setting/resource.go
@@ -248,3 +248,45 @@ func (r *UniversalSSLSettingResource) ModifyPlan(ctx context.Context, req resour
 		)
 	}
 }
+
+func (r *UniversalSSLSettingResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	var data *UniversalSSLSettingModel = new(UniversalSSLSettingModel)
+
+	path := ""
+	diags := importpath.ParseImportID(
+		req.ID,
+		"<zone_id>",
+		&path,
+	)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	data.ZoneID = types.StringValue(path)
+
+	res := new(http.Response)
+	env := UniversalSSLSettingResultEnvelope{*data}
+	_, err := r.client.SSL.Universal.Settings.Get(
+		ctx,
+		ssl.UniversalSettingGetParams{
+			ZoneID: cloudflare.F(path),
+		},
+		option.WithResponseBodyInto(&res),
+		option.WithMiddleware(logging.Middleware(ctx)),
+	)
+	if err != nil {
+		resp.Diagnostics.AddError("failed to make http request", err.Error())
+		return
+	}
+	bytes, _ := io.ReadAll(res.Body)
+	err = apijson.Unmarshal(bytes, &env)
+	if err != nil {
+		resp.Diagnostics.AddError("failed to deserialize http request", err.Error())
+		return
+	}
+	data = &env.Result
+	data.ID = data.ZoneID
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/internal/services/universal_ssl_setting/resource_test.go b/internal/services/universal_ssl_setting/resource_test.go
new file mode 100644
index 0000000000..305f0522a3
--- /dev/null
+++ b/internal/services/universal_ssl_setting/resource_test.go
@@ -0,0 +1,50 @@
+package universal_ssl_setting_test
+
+import (
+	"os"
+	"testing"
+
+	"github.com/cloudflare/terraform-provider-cloudflare/internal/acctest"
+	"github.com/cloudflare/terraform-provider-cloudflare/internal/consts"
+	"github.com/cloudflare/terraform-provider-cloudflare/internal/utils"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+)
+
+func testUniversalSSLSettingConfig(rnd, zoneID string, enabled bool) string {
+	return acctest.LoadTestCase("universalssl.tf", rnd, zoneID, enabled)
+}
+
+func TestAccCloudflareUniversalSSLSetting_Basic(t *testing.T) {
+	rnd := utils.GenerateRandomResourceName()
+	name := "cloudflare_universal_ssl_setting." + rnd
+	zoneID := os.Getenv("CLOUDFLARE_ZONE_ID")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.TestAccPreCheck(t) },
+		ProtoV6ProviderFactories: acctest.TestAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				// Create with enabled = true
+				Config: testUniversalSSLSettingConfig(rnd, zoneID, true),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, consts.ZoneIDSchemaKey, zoneID),
+					resource.TestCheckResourceAttr(name, "enabled", "true"),
+				),
+			},
+			{
+				// Update to enabled = false
+				Config: testUniversalSSLSettingConfig(rnd, zoneID, false),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(name, consts.ZoneIDSchemaKey, zoneID),
+					resource.TestCheckResourceAttr(name, "enabled", "false"),
+				),
+			},
+			{
+				// Import test
+				ResourceName:      name,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
diff --git a/internal/services/universal_ssl_setting/testdata/universalssl.tf b/internal/services/universal_ssl_setting/testdata/universalssl.tf
new file mode 100644
index 0000000000..79cdf3caff
--- /dev/null
+++ b/internal/services/universal_ssl_setting/testdata/universalssl.tf
@@ -0,0 +1,4 @@
+resource "cloudflare_universal_ssl_setting" "%[1]s" {
+	zone_id = "%[2]s"
+	enabled = %[3]t
+}