Enable mTLS

import { Render, DashButton } from "~/components";

You can enable mutual Transport Layer Security (mTLS) for any hostname. For more information, refer to the Client certificates overview.

:::note[Cloudflare-issued or BYOCA] The following process only refers to certificates issued from the Cloudflare-managed CA. For hostnames that should be validated using your own CA, refer to the BYOCA documentation. :::

To enable mTLS for a host from the Cloudflare dashboard:

1. In the Cloudflare dashboard, go to the Client Certificates page.

2. On the Hosts section of the Client Certificates card, select Edit.

3. Enter the name of a host in your current domain. :::note The domain (example.com) is automatically appended for you. This means that, if you want to enable mTLS for abc.example.com, you only need to type abc. :::

4. Select Save to confirm.

CAs in use

As explained in the Client certificates overview, Cloudflare validates client certificates against CAs set at account level. This means that these certificates can be used for validation across multiple zones/domains (example.com), as long as the zones are under the same Cloudflare account and you have enabled mTLS for the host.

:::note[Bring your own CA] If you need to use your own CA (instead of the Cloudflare-managed CA), refer to BYOCA. This option is available on Enterprise accounts. :::

Next steps

After enabling mTLS for your host, you can:

• Enforce mTLS with a WAF custom rule. Select Create mTLS Rule on the dashboard to use a template, or refer to our mTLS at Cloudflare learning path for further guidance.
• Enforce mTLS with API Shield. While API Shield is not required to use mTLS, many teams may use mTLS to protect their APIs.