Bring Your Own CA for mTLS on API Shield

APIs now account for more than half of all Internet traffic, and as their use grows, so does the volume of attacks targeting them. Cloudflare’s API Shield is designed to protect these endpoints, and it has relied on mutual TLS (mTLS) for client authentication since launch. Until now, that meant clients had to present certificates issued by a Cloudflare-managed, self-signed CA. That requirement is changing: API Shield now supports customer-supplied Certificate Authorities for mTLS validation.

Why mTLS Matters for APIs

Standard TLS proves the server’s identity to the client. With mTLS, both sides present certificates, creating a two-way trust channel. This lets the server verify who is connecting and whether they are allowed to make a request. The client certificate does not need to be publicly trusted; it’s typically issued by a private or self-signed CA. Only the connecting server needs to trust it, so public validation isn’t necessary.

When API Shield launched in 2020, it gave each customer a dedicated self-signed CA to issue client certificates. Administrators could then enforce that only devices holding certificates from that CA could connect. This approach has secured thousands of endpoints, but it requires installing new client certificates on every device.

That model doesn’t fit every deployment:

  • Some organizations have run mTLS for years with their own CA infrastructure, and their client certificates are already deployed in the field. Unless the application owner controls the clients directly, swapping those certificates for ones from Cloudflare’s CA is difficult or impossible.
  • Regulatory requirements may mandate that certificates come from an approved third-party CA.

To cover these cases, API Shield now lets customers upload their own CA and have Cloudflare validate client certificates against it.

Managing Private PKI at the Account Level

Cloudflare has consolidated private PKI management into a single account-level endpoint for uploading self-signed CAs. This endpoint is shared across products: it can be used for API Shield CAs and for Gateway CAs used in traffic inspection.

Enterprise customers can upload up to five CAs per account. After uploading, the API Shield hostname association API links the CA to hostnames that are mTLS-enabled. Cloudflare will then validate incoming client certificates against that CA for requests on those hostnames.

Before enforcing validation, you can set up a Firewall rule that logs events for valid or invalid certificates. That gives you a chance to confirm the configuration is correct before switching to enforcement mode, which drops unauthorized requests.

More details are in the developer documentation. For mutual TLS applied to corporate network access, the Access product offers a related path via an account representative.