导航|地址|刷新
Client certificates (mTLS)

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/ssl/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

SSL/TLS

/

Overview

Concepts

Get started

Edge certificates

Overview

Universal SSL

Overview

Enable Universal SSL certificates

Disable Universal SSL certificates

Alerts

Limitations

Troubleshooting

Advanced certificates

Overview

Manage advanced certificates

API commands

Custom certificates

Overview

Manage custom certificates

Renewal and expiration

Bundle methodologies

Remove key file password

Troubleshooting

Enforce HTTPS connections

Domain control validation (DCV)

Overview

Methods

Overview

Delegated

TXT

HTTP

Validation backoff schedule

Domain control validation flow

Troubleshooting

Geo Key ManagerBeta

Overview

Setup

Supported options

Add CAA records

Staging environmentBeta

Backup certificates

ECH ProtocolBeta

Additional options

Cipher suites

About

Customize cipher suites

Overview

Use the dashboard

Use the API

Security levels

Compliance standards

Supported cipher suites

Troubleshooting

Certificate Transparency MonitoringBeta

HTTP Strict Transport Security (HSTS)

Certificate Signing Requests (CSRs)

TLS 1.3

Minimum TLS Version

Automatic HTTPS Rewrites

Total TLS

Overview

Enable

Error messages

Always Use HTTPS

Opportunistic Encryption

Origin server

Encryption modes

Overview

Off (no encryption)

Flexible

Full

Full (strict)

Strict (SSL-Only Origin Pull)

Automatic key exchange to origins

SSL/TLS RecommenderDeprecated

Cloudflare origin CA

Setup

Troubleshooting

Authenticated Origin Pulls (mTLS)

Overview

About

AWS integration

Setup

Global

Zone-level

Per-hostname

Manage certificates

Rollback

Custom Origin Trust Store

Cipher suites

Client certificates (mTLS)

Overview

Create a client certificate

Enable mTLS

Bring your own CA (BYOCA)

Forward certificate to server

Label client certificates

Revoke a client certificate

Configure your mobile app or IoT device

Client certificate variables

Troubleshooting

mTLS for Zero Trust ↗

Cloudflare for SaaS ↗

Keyless SSL

Overview

Get started

Cloudflare Tunnel

Public DNS

Run with Docker

Hardware security modules

Overview

Configuration

AWS cloud HSM

Azure Dedicated HSM

Azure Managed HSM

Entrust nShield Connect

Fortanix DSM

Google Cloud HSM

IBM Cloud HSM

SoftHSMv2

Upgrade your key server

Reference

High availability

Scaling and benchmarking

Key server metrics

Keyless delegation

Glossary

Troubleshooting

Post-quantum

About PQC

PQC support

PQC in Cloudflare products

PQC to your origin

PQC and Cloudflare One

Reference

TLS protocols

Certificate and hostname priority

Certificate authorities

Browser compatibility

Migration guides

Entrust distrust

DigiCert G1 distrust

Rotate ACM certificate packs

Certificate pinning

Certificate statuses

Validity periods and renewal

Features and plans

Cloudflare and CVE-2019-1559

PCI compliance and vulnerabilities mitigation

Troubleshooting

Full resources list

General SSL errors

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

ERR_SSL_PROTOCOL_ERROR

ERR_TOO_MANY_REDIRECTS

Mixed content errors

FAQ

Changelog

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

SSL/TLS llms.txt ↗

SSL/TLS llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/SSL/TLS

/Client certificates (mTLS)

Client certificates (mTLS)

Last updated May 7, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewHow it worksUse cases mTLS and WorkersFurther resources

Standard TLS verifies the server's identity to the client. Mutual TLS (mTLS) adds a second check: the server also verifies the client's identity using a client certificate. This allows you to restrict access to devices or services that present a valid certificate.

Use Cloudflare's public key infrastructure (PKI) to create client certificates, or bring your own CA (BYOCA).

Mutual TLS (mTLS) authentication is a common security practice that uses client certificates to ensure traffic between client and server is bidirectionally secure and trusted. mTLS also allows requests that do not authenticate via an identity provider — such as Internet-of-things (IoT) devices — to demonstrate they can reach a given resource.

mTLS at Cloudflare

This documentation is focused on the SSL/TLS product. For a broader overview, refer to the mTLS at Cloudflare learning path.

------

How it works

When a hostname has mTLS enabled, Cloudflare requires connecting clients to present a valid certificate. Client certificates are installed on the devices or services that should be granted access.

Cloudflare validates client certificates against CAs set at the account level. Because validation is account-level, the same certificates work across multiple domains under your account, as long as mTLS is enabled for each hostname (for example, host.example.com, name.example.net, secure.anotherdomain.test).

The account-level CAs can be:

The Cloudflare-managed CA: This is the default option. Certificates and hostname associations are listed on the Cloudflare-issued tab of the Client Certificates dashboard ↗.

BYOCA certificates: Available on Enterprise accounts. Certificates and hostname associations are listed on the BYOCA tab of the Client Certificates dashboard ↗.

Cloudflare then stores the validation result in a field called cf.tls_client_auth.cert_verified:

Success: cf.tls_client_auth.cert_verified is true, and you can find client certificate details in specific mTLS fields.

Failure: cf.tls_client_auth.cert_verified is false.

------

Use cases

mTLS supports several implementation patterns depending on what you are protecting. For a broader overview, refer to the mTLS learning path.

Application security — restrict access to your web application based on client certificates

mTLS for Zero Trust — authenticate users and services through Cloudflare Access

mTLS with API Shield — validate API clients with certificate-based authentication

mTLS Workers binding — present a client certificate when your Worker connects to an external service

Apart from the mTLS Workers binding, any of the above implementations can use your own CA instead of the Cloudflare-managed one. Refer to Bring your own CA.

mTLS and Workers

Use the mTLS Workers binding when you need your worker to present a client certificate to an external service. To authenticate requests from a client to your worker instead, refer to the regular mTLS for application security implementation.
flowchart LR accTitle: mTLS from client to worker versus mTLS from worker to external service accDescr: Diagram showing two different implementations that can be considered for mTLS with Cloudflare Workers. A[Client] <--App security mTLS--> B((Cloudflare))<--mTLS worker binding--> C[(External service)]
------

Further resources

Create a client certificate

Enable mTLS

Bring your own CA for mTLS

Forward certificate to server

Label client certificates

Revoke a client certificate

Configure your mobile app or IoT device

Client certificate variables

Troubleshooting

mTLS for Zero Trust

PreviousCipher suitesNextCreate a client certificate

Was this helpful?

YesNo

Edit pageReport issue

On this page

Overview

How it works

Use cases

mTLS and Workers

Further resources

Edit pageReport issue

Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search

Company
AboutCareersInvestorsPressPress kitGlobal network

Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers
DocumentationLearning centerCommunity

Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices

Docs

------
导航页打开网址