Skip to content

[ZT] Update mTLS references in WARP docs #24181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 5, 2025
Merged

[ZT] Update mTLS references in WARP docs #24181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 1 addition & 19 deletions ...oudflare-one/identity/devices/access-integrations/mutual-tls-authentication.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,25 +33,7 @@ The mTLS certificate is used only to verify the client certificate. It does not

### Add mTLS to your Access application

1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Access** > **Service auth** > **Mutual TLS**.

2. Select **Add mTLS Certificate**.

3. Enter any name for the root CA.

4. In **Certificate content**, paste the contents of your root CA.

If the client certificate is directly signed by the root CA, you only need to upload the root. If the client certificate is signed by an intermediate certificate, you must upload the entire CA chain (intermediate and root). For example:
```txt
-----BEGIN CERTIFICATE-----
<intermediate.pem>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<rootCA.pem>
-----END CERTIFICATE-----
```

Do not include any SSL/TLS server certificates; Access only uses the CA chain to verify the connection between the user's device and Cloudflare.
<Render file="access/add-mtls-cert" product="cloudflare-one" params={{ product: "access"}}/>

5. In **Associated hostnames**, enter the fully-qualified domain names (FQDN) that will use this certificate.

Expand Down
2 changes: 1 addition & 1 deletion .../docs/cloudflare-one/identity/devices/warp-client-checks/client-certificate.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ The Client Certificate device posture attribute checks if the device has a valid

:::note

You can use the [Cloudflare PKI toolkit](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-mtls-using-cloudflare-pki) to generate a sample root CA for testing.
To generate a sample root CA for testing, refer to [Generate mTLS certificates](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#generate-mtls-certificates).
:::

## Configure the client certificate check
Expand Down
24 changes: 24 additions & 0 deletions src/content/partials/cloudflare-one/access/add-mtls-cert.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
---
params:
- product
---

1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Access** > **Service auth** > **Mutual TLS**.

2. Select **Add mTLS Certificate**.

3. Enter any name for the root CA.

4. In **Certificate content**, paste the contents of your root CA.

If the client certificate is directly signed by the root CA, you only need to upload the root. If the client certificate is signed by an intermediate certificate, you must upload the entire CA chain (intermediate and root). For example:
```txt
-----BEGIN CERTIFICATE-----
<intermediate.pem>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<rootCA.pem>
-----END CERTIFICATE-----
```

{ props.product === "access" && (<> Do not include any SSL/TLS server certificates; Access only uses the CA chain to verify the connection between the user's device and Cloudflare. </>)}
14 changes: 9 additions & 5 deletions src/content/partials/cloudflare-one/warp/device-enrollment-mtls.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,23 +3,27 @@

---

import { GlossaryTooltip, Tabs, TabItem } from "~/components"
import { GlossaryTooltip, Tabs, TabItem, Render, Details } from "~/components"

<Details header="Certificate requirements">
<Render file="byo-ca-mtls-cert-requirements" product="ssl" />
</Details>

To check for an mTLS certificate:

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

1. [Add an mTLS certificate](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#add-mtls-authentication-to-your-access-configuration) to your account. You can generate a sample certificate using the [Cloudflare PKI toolkit](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-mtls-using-cloudflare-pki).
<Render file="access/add-mtls-cert" product="cloudflare-one" params={{ product: "warp"}}/>

2. In **Associated hostnames**, enter your Zero Trust <GlossaryTooltip term="team domain">team domain</GlossaryTooltip>: `<team-name>.cloudflareaccess.com`
5. In **Associated hostnames**, enter your Zero Trust <GlossaryTooltip term="team domain">team domain</GlossaryTooltip>: `<team-name>.cloudflareaccess.com`

3. In your [device enrollment permissions](#set-device-enrollment-permissions), add a *Common Name* or *Valid Certificate* rule. For example, the following policy requires a client certificate with a specific common name:
6. In your [device enrollment permissions](#set-device-enrollment-permissions), add a *Common Name* or *Valid Certificate* rule. For example, the following policy requires a client certificate with a specific common name:

| Action | Rule type | Selector | Value |
| ------ | --------- | ----------- | -------------------- |
| Allow | Require | Common Name | `<CERT-COMMON-NAME>` |

4. On your device, add the client certificate to the [system keychain](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-in-the-browser).
7. On your device, add the client certificate to the [system keychain](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-in-the-browser).

</TabItem> <TabItem label="Terraform (v5)">

Expand Down