Bring your own CA for client certificate validation with API Shield
Jul 11, 2023Dina Kozlov
Summary
Introduced the ability for customers to upload their own Certificate Authorities (CAs) to API Shield for mutual TLS (mTLS) client certificate validation. This allows customers to leverage their existing PKI infrastructure or meet regulatory requirements by using CAs other than the self-signed CA previously provided by Cloudflare. The feature supports uploading up to five CAs per account and associating them with specific hostnames via the API Shield hostname association API. It also includes a logging mechanism via Firewall rules to test setup before enforcing validation.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack