Keyless SSL key servers can now stay fully off the public Internet
Cloudflare has announced an update to Keyless SSL that lets customers connect their key servers through Cloudflare Tunnel, removing the need to expose those servers to the public Internet. Previously, the IP address of a key server had to be published in a DNS record, even if the hostname itself was obfuscated with a long random string.
Why Keyless SSL exists
Keyless SSL, introduced in 2014, was designed for customers who need to keep their private keys on their own hardware rather than uploading them to Cloudflare. This is often driven by compliance requirements in industries such as financial or medical services, where sharing private keys with a third party may be prohibited. The feature allows customers to retain full control of their keys while still using Cloudflare’s Layer 7 proxy services.
The private keys can be stored on any hardware that supports the PKCS#11 standard. In practice, many customers choose Hardware Security Modules (HSMs), which are tamper-resistant devices optimized for cryptographic operations like signing and decryption. In 2021, Cloudflare added integrations between Keyless SSL and HSM offerings from all major cloud providers.
The exposure problem
Setting up Keyless SSL required customers to create a DNS record pointing to the key server's IP address. Even when that record used a long, random hostname (for example, 11aa40b4a5db06d4889e48e2f738950ddfa50b7349d09b5f.example.com), the IP address was still publicly queryable. Anyone could send requests directly to the server.
Cloudflare locked down the connection between its edge and the key server with Mutual TLS, so the server would reject requests without a valid Cloudflare client certificate. However, the server remained publicly reachable, meaning it could still be subjected to network-level attacks even if those attacks were unlikely to succeed.
Using Cloudflare Tunnel as the transport
Instead of building a new mechanism, Cloudflare has extended its existing Cloudflare Tunnel product to cover key server connections. Cloudflare Tunnel is designed to connect incoming traffic to private networks without requiring those networks to expose a public hostname. It works by running a cloudflared daemon on the customer's side; Cloudflare's edge connects to that daemon when it needs to reach a resource on the private network.
The new workflow allows customers to route Keyless SSL traffic over the same secure channel. The key server no longer needs a public IP address at all, and Cloudflare becomes the only party that can initiate contact with it.
Configuration
To use the new integration, customers must first define a virtual network in their Cloudflare account and specify the IP address or hostname of the key server within that network. Then, when uploading a Keyless certificate, the customer can reference that virtual network rather than a public hostname.
When Cloudflare’s gokeyless client needs to reach the key server, it will automatically connect through the cloudflared daemon instead of sending traffic over the public Internet. Mutual TLS remains in effect as an additional layer of security on the connection to the key server.
Setup instructions are available in the Cloudflare Developer Docs. The combined Keyless SSL and Cloudflare Tunnel offering is available to Enterprise customers through their account teams.
