You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/learning-paths/mtls/mtls-app-security/index.mdx
+15-11
Original file line number
Diff line number
Diff line change
@@ -16,9 +16,9 @@ By default, mTLS uses Client Certificates issued by a Cloudflare Managed CA. Clo
16
16
## 1. Enable mTLS
17
17
18
18
1. Go to your Cloudflare dashboard and select your account and domain.
19
-
2. Go to **SSL/TLS** > **[Client Certificates](/ssl/client-certificates/)** tab and select **Edit** to add the Hosts (hostnames) you want to [enable mTLS](/ssl/client-certificates/enable-mtls/) for.
19
+
2. Go to **SSL/TLS** > **[Client Certificates](/ssl/client-certificates/)** tab and select **Edit** to add the Hosts (hostnames) you want to [enable mTLS](/ssl/client-certificates/enable-mtls/) for.
20
20
21
-
Example host: `mtls-test.example.com`
21
+
Example host: `mtls-test.example.com`
22
22
23
23
3. Select **Create Certificate** and fill in the required fields. You can choose one of the following options:
24
24
@@ -27,7 +27,7 @@ By default, mTLS uses Client Certificates issued by a Cloudflare Managed CA. Clo
27
27
28
28
To generate and use your own CSR, you can run a command like the following:
@@ -41,19 +41,19 @@ In order for a client to utilize the Client Certificate you created, it must be
41
41
42
42
We generally recommended using one Client Certificate per device. Configuring your system to actually use the Public and Private Certificates is especially important.
43
43
44
-
An example is to [add both certificates to the Keychain](https://support.apple.com/en-gb/guide/keychain-access/kyca2431/mac) on a MacBook laptop.
44
+
An example is to [add both certificates to the Keychain](https://support.apple.com/en-gb/guide/keychain-access/kyca2431/mac) on a MacBook laptop.
45
45
46
46
Another example is to generate a [PKCS12 (P12) certificate](https://en.wikipedia.org/wiki/PKCS_12) file and then [add it to your browser](https://www.ibm.com/docs/en/engineering-lifecycle-management-suite/lifecycle-management/7.0.2?topic=dashboards-importing-certificates-configuring-browsers):
Copy file name to clipboardExpand all lines: src/content/docs/learning-paths/mtls/mtls-cloudflare-access/index.mdx
+45-41
Original file line number
Diff line number
Diff line change
@@ -11,8 +11,8 @@ This requires an active Enterprise [Account](/fundamentals/setup/accounts-and-zo
11
11
12
12
Setting up [mTLS](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) with [Cloudflare Access](/cloudflare-one/policies/access/) can help in cases where the customer:
13
13
14
-
- Already has existing Client Certificates on devices.
15
-
- Needs to protect Access applications with Bring Your Own CA (BYOCA).
14
+
- Already has existing Client Certificates on devices.
15
+
- Needs to protect Access applications with Bring Your Own CA (BYOCA).
16
16
- Needs to integrate with a Zero Trust solution.
17
17
18
18
## 1. Create a CA
@@ -25,42 +25,42 @@ In case you want to [create your own CA](/cloudflare-one/identity/devices/access
2. Now you can run the following command to generate the Client Certificates, which will output the files `client.pem`, `client-key.pem` and `client.csr`:
@@ -114,7 +114,7 @@ Additionally, authenticated requests also send the `Cf-Access-Jwt-Assertion\` JW
114
114
115
115
## 4. Create the self-hosted applications
116
116
117
-
Finally, the hostname you want to protect with mTLS needs to be added as a [self-hosted app](/cloudflare-one/applications/configure-apps/self-hosted-apps/) in Cloudflare Access, defining an [Access Policy](/cloudflare-one/policies/access/) which uses the action [Service Auth](/cloudflare-one/policies/access/#service-auth) and the Selector *“Valid Certificate”*, or simply requiring an [IdP](/cloudflare-one/identity/idp-integration/) authentication. You can also take advantage of extra requirements, such as the “Common Name” (CN), which expects the indicated hostname, and more [Selectors](/cloudflare-one/policies/access/#selectors). Alternatively, one can also [extend ZTNA with external authorization and serverless computing](/reference-architecture/diagrams/sase/augment-access-with-serverless/).
117
+
Finally, the hostname you want to protect with mTLS needs to be added as a [self-hosted app](/cloudflare-one/applications/configure-apps/self-hosted-apps/) in Cloudflare Access, defining an [Access Policy](/cloudflare-one/policies/access/) which uses the action [Service Auth](/cloudflare-one/policies/access/#service-auth) and the Selector _"Valid Certificate"_, or simply requiring an [IdP](/cloudflare-one/identity/idp-integration/) authentication. You can also take advantage of extra requirements, such as the "Common Name" (CN), which expects the indicated hostname, and more [Selectors](/cloudflare-one/policies/access/#selectors). Alternatively, one can also [extend ZTNA with external authorization and serverless computing](/reference-architecture/diagrams/sase/augment-access-with-serverless/).
118
118
119
119
## Demo
120
120
@@ -124,18 +124,22 @@ Make sure that you are not using any VPN that could interfere with the certifica
124
124
125
125
With the Public and Private Client Certificates in the same directory, with this cURL command, we will gain access:
@@ -393,8 +389,6 @@ The above code does the following:
393
389
394
390
To use Workers AI, you will need to add the Workers AI binding to the `wrangler.toml` file. The `wrangler.toml` file should contain the following code:
0 commit comments