Cloudflare Workers Now Speak mTLS Natively

Zero Trust security models depend on verifying every actor trying to reach a protected resource — not just the server, but also the client making the request. Cloudflare has long enforced mutual TLS (mTLS) at the edge through products like API Shield and Cloudflare Access. Now, the company has extended that capability directly to its serverless compute platform: mTLS for Workers is generally available to all Cloudflare Workers customers.

This update lets a Worker authenticate itself to downstream services that demand a client certificate — APIs, microservices, databases, or IoT endpoints — without routing that traffic through an external proxy or gateway. Instead, the Worker presents a certificate during its own outbound TLS handshake.

Why mTLS Goes a Step Beyond TLS

Standard TLS, the encryption layer behind every HTTPS connection, works by having the client verify the server's identity via a digital certificate. That one-way verification is fine for public-facing sites where anyone should be able to connect. But it leaves the server with no cryptographic proof of who the client is.

mTLS flips the model: during the handshake, the server sends a "Certificate Request" to the client, and the client responds with its own signed certificate. Both parties end up authenticated. Because mTLS uses cryptographically signed certificates rather than passwords or tokens, the credentials are far harder to spoof — making it a strong fit for sensitive server-to-server communications, database access from authorized hosts, and machine-to-machine IoT connections.

Configuring mTLS in a Worker

Setting up mTLS on a Worker requires no special middleware or custom TLS logic. The configuration involves three steps handled through wrangler and the Workers runtime:

  1. Upload the client certificate and private key from the service that enforces mTLS using wrangler.
  2. Declare an mtls_certificates binding in the project's wrangler.toml file, referencing the certificate ID returned after upload.
  3. Attach that binding to any fetch() request where the Worker needs to authenticate as a client.
wrangler mtls-certificate upload --cert cert.pem --key key.pem --name my-client-cert
mtls_certificates = [
 { binding = "MY_CERT", certificate_id = "<CERTIFICATE_ID>" }
]
index.js

export default {
   async fetch(request, environment) {
       return await environment.MY_CERT.fetch("https://example-secure-origin.com")
   }

}

Workers that connect to multiple mTLS-protected hosts can manage separate certificates for each destination, allowing per-request granularity within a single Worker. Accounts are limited to 1,000 uploaded certificates by default; teams exceeding that limit can request an increase from their account team or the Cloudflare Developer Discord.

Full setup instructions and runtime API details are available in the client authentication with mTLS developer documentation.