Client certificate

import { Details, Render, TabItem, Tabs } from "~/components";

The Client Certificate device posture attribute checks if the device has a valid client certificate signed by a trusted certificate. The trusted certificate is uploaded to Cloudflare and specified as part of the posture check rule. The client certificate posture check can be used in Gateway and Access policies to ensure that the user is connecting from a managed device.

Prerequisites

• A CA that issues client certificates for your devices. The Cloudflare One Client does not evaluate the certificate trust chain; this needs to be the issuing certificate.

  :::note[Upload the signing certificate that issued the client certificate]

  When uploading a certificate to use in posture checks, Cloudflare does not differentiate between root and intermediate certificates. You must upload the actual signing certificate - the one that directly signed the client certificate.

  If you upload a different certificate, even if it exists higher up in the trust chain (for example, the root that issued the signing certificate), the posture check will fail.

  :::

• Cloudflare One Client is deployed on the device.

• A client certificate is installed and trusted on the device.

:::note

To generate a sample root CA for testing, refer to Generate mTLS certificates. :::

Configure the client certificate check

1. <Render file="upload-mtls-cert" product="cloudflare-one" params={{ key: "The private key is only required if you are using this custom certificate for Gateway HTTPS inspection.", cert: "signing certificate", }} />

2. In the Cloudflare dashboard, go to Zero Trust > Reusable components > Posture checks.

3. Go to Cloudflare One Client checks and select Add a check.

4. Select Client certificate.

5. You will be prompted for the following information:

   1. Name: Enter a unique name for this device posture check.

   2. Operating system: Select your operating system.

   3. OS locations: Specify the location(s) where the client certificate is installed.

      - Local machine trust store - User trust store
      • System keychain
      - NSSDB (`/etc/pki/nssdb`) - To search a custom location, enter the absolute file path(s) to the certificate and private key (for example `/usr/local/mycompany/certs/client.pem` and `/usr/local/mycompany/certs/client_key.pem`). The certificate and private key must be in `PEM` format. They can either be in two different files or the same file.

   4. Certificate ID: Enter the UUID of the signing certificate.

   5. Common name: (Optional) To check for a Common Name (CN) on the client certificate, enter a string with optional ${serial_number} and ${hostname} variables (for example, ${serial_number}_mycompany). The Cloudflare One Client will search for an exact, case-insensitive match. If you do not specify a common name, the Cloudflare One Client will ignore the common name field on the certificate.

   6. Check for Extended Key Usage: (Optional) Check whether the client certificate has one or more attributes set. Supported values are Client authentication (1.3.6.1.5.5.7.3.2) and/or Email (1.3.6.1.5.5.7.3.4).

   7. Check for private key: (Recommended) When enabled, WARP checks that the device has a private key associated with the client certificate.

   8. Subject Alternative Name: (Optional) To check for a Subject Alternative Name (SAN) on the client certificate, enter a string with optional ${serial_number} and ${hostname} variables (for example, ${serial_number}_mycompany). The Cloudflare One Client matches supported SAN types exactly, ignoring case. The client certificate posture check does not match otherName SAN entries. You can add multiple SAN values to the posture check. One value with a supported SAN type must match.

6. Select Save.

Next, go to Insights > Logs > Posture logs and verify that the client certificate check is returning the expected results.

Troubleshooting

You can use the following commands to check if a client certificate is properly installed and trusted on the device.

1. Open a PowerShell window.
2. To search the local machine trust store for a certificate with a specific common name, run the following command:

Get-ChildItem Cert:\LocalMachine\My\ | where{$_.Subject -like "*<COMMON_NAME>*"}

3. To search the user trust store for a certificate with a specific common name, run the following command:

Get-ChildItem Cert:\CurrentUser\My\ | where{$_.Subject -like "*<COMMON_NAME>*"}

1. Open Terminal.
2. To search System Keychain for a certificate with a specific common name, run the following command:

/usr/bin/security find-certificate -c "<COMMON_NAME>" -p /Library/Keychains/System.keychain

1. Open Terminal.
2. To list all client certificates in NSSDB, run the following command:

certutil -L -d /etc/pki/nssdb

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

meow                                                         CTu,Cu,Cu
noPrivateKey                                                 CT,,

3. Open your desired certificate using its certificate nickname. The common name will appear in the line Subject: "CN=123456.mycompany".

certutil -L -d /etc/pki/nssdb -n meow

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 236 (0xec)
        Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
        Issuer: "CN=123456.mycompany"
        Validity:
            Not Before: Tue Jul 02 17:20:40 2024
            Not After : Sun Jul 02 17:20:40 2034
        Subject: "CN=123456.mycompany"
        Subject Public Key Info:
            Public Key Algorithm: PKCS #1 RSA Encryption
            RSA Public Key:
                Modulus:
                    <redacted>
                Exponent: 65537 (0x10001)
    Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
    Signature:
        <redacted>
    Fingerprint (SHA-256):
        <redacted>
    Fingerprint (SHA1):
        <redacted>

    Mozilla-CA-Policy: false (attribute missing)
    Certificate Trust Flags:
        SSL Flags:
            Valid CA
            Trusted CA
            User
            Trusted Client CA
        Email Flags:
            Valid CA
            Trusted CA
            User
        Object Signing Flags:
            Valid CA
            Trusted CA
            User

For the posture check to pass, a certificate must appear in the output that validates against the uploaded signing certificate.