Skip to content

[SSL, CF4SaaS] Clarify CA cert is validated and CNAME config with mTLS #25667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 8, 2025
Merged

[SSL, CF4SaaS] Clarify CA cert is validated and CNAME config with mTLS #25667

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b5277d4
Explicitly call out that uploaded CA certs are validated
RebeccaTamachiro Oct 7, 2025
1afe323
Add note about where to enforce mTLS when CNAME is in place
RebeccaTamachiro Oct 7, 2025
7a8301a
Improve excessive passive voice
RebeccaTamachiro Oct 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ...-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@ Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for

:::note
Currently, you cannot add mTLS policies for custom hostnames using [API Shield](/api-shield/security/mtls/).

Also make sure to enforce mTLS on the specific custom hostname where it should be checked. It is not enough to have it set on the CNAME target.
:::

## Minimum TLS Version
Expand Down
4 changes: 4 additions & 0 deletions src/content/docs/learning-paths/mtls/mtls-app-security/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,10 @@ Example WAF Custom Rule with action block:

![Example of a WAF custom rule with an action block in the Cloudflare dashboard during the validate client certificate step](~/assets/images/learning-paths/mtls/waf-custom-rule-action-block.png)

:::note
When using CNAME, enforce mTLS on the specific hostname where it should be checked. It is not enough to have it set on the CNAME target.
:::

## Demo

:::note
Expand Down
6 changes: 6 additions & 0 deletions src/content/docs/ssl/client-certificates/byo-ca.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ Bring your own CA (BYOCA) is especially useful if you already have mTLS implemen

## CA certificate requirements

When you upload your CA, Cloudflare validates the certificate according to certain requirements.

<Render file="byo-ca-mtls-cert-requirements" product="ssl" />

:::note
Expand Down Expand Up @@ -71,6 +73,10 @@ Uploading the CA private key is only required if you wish to use [Zero Trust's b
"action": "block"
```

:::note
When using CNAME, enforce mTLS on the specific hostname where it should be checked. It is not enough to have it set on the CNAME target.
:::

### Multiple CAs for one hostname

There can be multiple CAs (Cloudflare-managed or BYOCA) associated with the same hostname. For BYOCA certificates, the most recently deployed certificate will be prioritized.
Expand Down
Loading