is it possible to implement mTLS using cloudflare free plan or not?

Cyb3r-Jak3•10/5/24, 3:01 PM

Yes.
https://developers.cloudflare.com/ssl/client-certificates/

Cloudflare Docs

Client certificates | Cloudflare SSL/TLS docs

Use Cloudflare public key infrastructure (PKI) to create client certificates and enforce mutual Transport Layer Security (mTLS) encryption.

a4amaanOP•10/8/24, 1:44 PM

thanks i implemented it and its working fine.. one last think its working for example.com but not api.example.com and i saw this.. is there any solution for it so that it work on subdomain?

a4amaanOP•10/8/24, 1:45 PM

do i will need to create certs locally?

Cyb3r-Jak3•10/8/24, 2:26 PM

It should work fine as long as the certificate match

MDev•10/8/24, 4:17 PM

Note that * wildcards are not supported, the api.example.com domain will probably require its own cert or re-create your existing cert to include api subdomain

MMDev Note that * wildcards are not supported, the api.example.com domain will probabl...

a4amaanOP•10/8/24, 6:15 PM

for this you mean adding api.example.com in SSL/TSL -> Origion Certificate or SSL/TSL -> Edge Certificates ????

MDev•10/8/24, 6:25 PM

the cert on your origin, where api resolves to

MDev•10/8/24, 6:27 PM

if it's SSL protected by the wildcard, *.example.com thats probably the issue, needs to be explicitlly set

api.example.com

a4amaanOP•10/8/24, 6:29 PM

i removed * one and added api.example.com, regenerated cliente cert and followed all steps but its not accessible with or without certificate

MDev•10/8/24, 6:29 PM

tried again with a hard refresh? CTRL Shift R?

a4amaanOP•10/8/24, 6:30 PM

i am testing it with python requests library

a4amaanOP•10/8/24, 6:30 PM

it was working for example.com

a4amaanOP•10/8/24, 6:30 PM

but not for subdomain

MDev•10/8/24, 6:30 PM

Ooh if you visit the domain in a browser, what does the SSL cert tell you? valid?

a4amaanOP•10/8/24, 6:32 PM

yes app is working fine with ssl, but when i activate WAF rule it is not accessible

MDev•10/8/24, 6:32 PM

is it for *.example.com or the api.example.com the cert viewed from browser?

a4amaanOP•10/8/24, 6:33 PM

it saying example.com

MDev•10/8/24, 6:35 PM

My CF proxied records for example will still display:

Not critical
DNS Name: example.com
DNS Name: *.example.com

Not critical
DNS Name: example.com
DNS Name: *.example.com

even with custom SSL certs on my origin. But i don't want you to un-proxy the record either. I hope there's a way to generate custom certs, probably with the custom cert manager on Cloudflare

Aa4amaan it saying example.com

MDev•10/8/24, 6:35 PM

for the url api.example.com cert only for example.com?

a4amaanOP•10/8/24, 6:36 PM

i have DM you the url...

a4amaanOP•10/8/24, 7:06 PM

here is a working example for domain example.com with and without client certificate

a4amaanOP•10/8/24, 7:07 PM

but samething is not working in case of subdomain abc.example.com

is it possible to implement mTLS using cloudflare free plan or not?

Similar Threads

Similar Threads

Similar Threads