Skip to content

Commit 5add7d1

Browse files
ranbelranbel
committed
add client cert locations
1 parent 826ab99 commit 5add7d1

File tree

1 file changed

+83
-30
lines changed

1 file changed

+83
-30
lines changed

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/device-information-only.mdx‎

Lines changed: 83 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,26 @@ sidebar:
66

77
---
88

9-
import { TabItem, Tabs } from "~/components"
9+
import { TabItem, Tabs, Details, Width } from "~/components"
10+
11+
<Details header="Feature availability">
12+
13+
| System | Availability |
14+
| ---------| -------------|
15+
| Windows | ✅ |
16+
| macOS | ✅ |
17+
| Linux | ✅ |
18+
| iOS | ✅ |
19+
| Android | ✅ |
20+
| ChromeOS | ✅ |
21+
22+
</Details>
1023

1124
Device Information Only mode allows you to enforce device posture rules when a user connects to your [self-hosted Access application](/cloudflare-one/applications/configure-apps/self-hosted-public-app/). This mode relies on a client certificate generated from your account to establish trust between the Access application and the device.
1225

13-
To set up Device Information Only mode:
26+
## 1. Turn on account settings
1427

15-
1. Enable client certificate provisioning for [your zone](/fundamentals/setup/find-account-and-zone-ids/):
28+
Using the API, enable client certificate provisioning for [your zone](/fundamentals/setup/find-account-and-zone-ids/):
1629

1730
```bash
1831
curl --request PATCH \
@@ -23,55 +36,95 @@ To set up Device Information Only mode:
2336
--data '{"enabled": true}'
2437
```
2538

26-
2. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**.
39+
## 2. Configure the WARP client
2740

28-
3. In the **Profile settings** card, choose a [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) and select **Configure**.
41+
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**.
2942

30-
4. For **Service mode**, select **Device Information Only**.
43+
2. Under **Profile settings** card, choose a [device profile](/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/) and select **Configure**.
3144

32-
5. Next, [enroll your device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) into your Zero Trust organization.
45+
3. For **Service mode**, select **Device Information Only**.
46+
47+
4. [Enroll your device](/cloudflare-one/connections/connect-devices/warp/deployment/manual-deployment/) into your Zero Trust organization.
3348

3449
When enrolled in Device Information Only mode, the WARP client will automatically generate a client certificate and install the certificate on the device. This certificate is necessary to confirm the source of outgoing traffic.
3550

36-
6. (Optional) Verify the client certificate on the device:
51+
## 3. (Optional) Verify the client certificate
52+
53+
1. To view the client certificates installed on the device:
54+
55+
<Tabs> <TabItem label="Windows">
56+
57+
1. Open the Start menu and select **Run**.
58+
2. Enter `certlm.msc`.
59+
3. Go to **Personal** > **Certificates**.
60+
61+
</TabItem> <TabItem label="macOS">
62+
63+
1. Open **Keychain Access**.
64+
2. Go to **System** > **My Certificates**.
65+
66+
The certificate name should match the **Device ID** in your WARP client **Preferences**.
67+
68+
</TabItem>
69+
70+
<TabItem label="Linux">
3771

38-
<Tabs> <TabItem label="Windows">
72+
Open a terminal window and run the following command:
3973

40-
1. Open the Start menu and select **Run**.
41-
2. Enter `certlm.msc`.
42-
3. Go to **Personal** > **Certificates**.
74+
```sh
75+
$ certutil -L -d sql:/etc/pki/nssdb
76+
```
4377

44-
The certificate name should match the **Device ID** in your WARP client **Preferences**.
45-
![Verifying the Device Information Only mode certificate in Windows](~/assets/images/cloudflare-one/connections/device-information-only-windows.png)
78+
</TabItem>
4679

47-
</TabItem> <TabItem label="macOS">
80+
<TabItem label="iOS">
4881

49-
1. Open **Keychain Access**.
50-
2. Go to **System** > **My Certificates**.
82+
Go to **Settings** > **General** > **About** > **Certificate Trust Settings**.
5183

52-
The certificate name should match the **Device ID** in your WARP client **Preferences**.
84+
</TabItem>
5385

54-
</TabItem> </Tabs>
86+
<TabItem label="Android">
5587

56-
7. (Optional) Verify the client certificate in your Cloudflare account:
88+
The location of the client certificate may vary depending on the Android device.
89+
90+
- **Samsung**: Go to **Settings** > **Security** > **Other security settings** > **View security certificates**.
91+
- **Google Pixel**: Go to **Security** > **Advanced settings** > **Encryption & credentials** > **Credential storage**.
92+
93+
</TabItem>
94+
95+
<TabItem label="ChromeOS">
96+
97+
Go to **Settings** > **Apps** > **Google Play Store** > **Manage Android Preferences** > **Security** > **Credentials**.
98+
99+
</TabItem>
100+
</Tabs>
101+
102+
The client certificate name should match the **Device ID** in your WARP client **Preferences**.
103+
104+
2. To verify the client certificate in your Cloudflare account:
57105

58106
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), select the zone for which you enabled client certificates.
59107
2. Go to **SSL/TLS** > **Client Certificates**.
60108

61109
The certificate name is the WARP enrollment **Device ID**.
62110
![Example client certificate in the Cloudflare dashboard](~/assets/images/cloudflare-one/connections/device-information-only-cert.png)
63111

64-
8. Lastly, block traffic from devices that do not have a valid client certificate:
65-
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **SSL/TLS** > **Client Certificates**.
66-
2. Under **Hosts**, add the domain you want to protect with device posture rules.
67-
3. Select **Create mTLS rule**.
68-
4. Change the **URI path** field to **Hostname**, and enter the domain you want to protect.
69-
5. Select **Deploy**. This creates a WAF custom rule that checks all requests to your domain for a valid client certificate.
112+
## 4. Enforce the client certificate
70113

71-
Device Information Only mode is now enabled on the device. To start enforcing device posture, set up a [WARP client check](/cloudflare-one/identity/devices/warp-client-checks/) and add a *Require* device posture rule to your [Access policy](/cloudflare-one/policies/access/). When the device connects to the Access application for the first time, the browser will ask to use the client certificate installed by WARP.
114+
To block traffic from devices that do not have a valid client certificate:
72115

73-
<div class="large-img">
116+
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **SSL/TLS** > **Client Certificates**.
117+
2. Under **Hosts**, select **Edit** and enter the hostname of your Access application (for example, `app.mycompany.com`). This enables mTLS authentication for the application.
118+
3. Select **Create mTLS rule**.
119+
4. Create a WAF custom rule that checks all requests to your application for a valid client certificate:
120+
| Field | Operator | Value | Logic | Action |
121+
| ----- | -------- | ----- | ----- | ------ |
122+
| Client Certificate | equals | Off | And | Block |
123+
| Hostname | equals | `app.mycompany.com` | | |
124+
5. Select **Deploy**.
74125

75-
![Browser prompts for client certificate](~/assets/images/cloudflare-one/connections/device-information-only-browser.png)
126+
Device Information Only mode is now enabled on the device. To start enforcing device posture, set up a [WARP client check](/cloudflare-one/identity/devices/warp-client-checks/) and add a *Require* device posture rule to your [Access policy](/cloudflare-one/policies/access/). When the device connects to the Access application for the first time, the browser will ask to use the client certificate installed by WARP.
76127

77-
</div>
128+
<Width size="large">
129+
![Browser prompts for client certificate](~/assets/images/cloudflare-one/connections/device-information-only-browser.png)
130+
</Width>

0 commit comments

Comments
 (0)