Resolving a Mutual TLS session resumption vulnerability

What this post added

This post details a vulnerability in Cloudflare's Mutual TLS (mTLS) implementation related to session resumption, tracked as CVE-2025-23419. A flaw in how BoringSSL handled session caches allowed a client with a valid mTLS certificate for one zone to resume a TLS session with another zone without re-authentication. Cloudflare mitigated this by disabling TLS session resumption for all customers with mTLS enabled and is exploring ways to reintroduce performance benefits. The post also provides guidance on further hardening mTLS configurations using Transform Rules, logging, and WAF custom rules, including passing client certificate metadata to origins.