Implementing mTLS end-to-end

Create a CA & client certificate CLI

Generate your own CA, then issue a client cert signed by it:

# 1a. Root CA
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
  -subj "/CN=Pimenta Lab Client CA" -out ca.pem

# 1b. Client key + CSR
openssl genrsa -out client.key 2048
openssl req -new -key client.key -subj "/CN=lab-client" -out client.csr

# 1c. Sign the client cert with the CA
openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key \
  -CAcreateserial -days 365 -sha256 -out client.crt

# 1d. (optional) bundle for browsers
openssl pkcs12 -export -inkey client.key -in client.crt \
  -certfile ca.pem -out client.p12

Register the CA with Cloudflare Dashboard API

Dashboard: SSL/TLS → Client Certificates (or Security → API Shield → mTLS) → Add mTLS certificate → paste the contents of ca.pem.

Or via API (upload the CA to the mTLS certificate store):

curl -X POST \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/certificate_authorities/hostname_associations" \
  -H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" \
  --data '{"certificates":[""]}'

Associate the hostname & require mTLS Dashboard

Enable mTLS for the hostname (e.g. mtls.pimenta.fun), then enforce it with a WAF custom rule so unverified clients are blocked:

# Expression (Security -> WAF -> Custom rules)
(http.host eq "mtls.pimenta.fun" and not cf.tls_client_auth.cert_verified)

# Action: Block   (or "Skip" the rule to allow only when verified)

Test the client leg CLI

# Without a cert -> blocked (403)
curl -i https://mtls.pimenta.fun/

# With the client cert -> allowed
curl -i --cert client.crt --key client.key https://mtls.pimenta.fun/

Browsers: import client.p12 into the OS/keychain; the browser prompts to send it.

Choose a mode & enable AOP Dashboard

• Zone-level: SSL/TLS → Origin Server → Authenticated Origin Pulls → On. Cloudflare presents its shared origin-pull certificate; your origin trusts Cloudflare's origin-pull CA.
• Per-hostname: upload your own client cert/key via API and bind it to the hostname — stronger isolation per zone.

Get the CA the origin should trust CLI

For zone-level AOP, download Cloudflare's origin-pull CA and place it on the origin:

sudo mkdir -p /etc/apache2/cloudflare
sudo curl -fsSL \
  https://developers.cloudflare.com/ssl/static/authenticated_origin_pull_ca.pem \
  -o /etc/apache2/cloudflare/origin-pull-ca.pem

For per-hostname AOP, trust the CA that signed the cert you uploaded instead.

Require & verify the client cert on the origin (Apache)

Add to your origin's :443 vhost so Apache demands Cloudflare's certificate:

<VirtualHost *:443>
    ServerName mtls.pimenta.fun
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/mtls.pimenta.fun/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/mtls.pimenta.fun/privkey.pem

    # --- Authenticated Origin Pulls ---
    SSLVerifyClient        require
    SSLVerifyDepth         1
    SSLCACertificateFile   /etc/apache2/cloudflare/origin-pull-ca.pem
</VirtualHost>

nginx equivalent: ssl_client_certificate + ssl_verify_client on;

Reload & lock down CLI

sudo apache2ctl configtest && sudo systemctl reload apache2

Optionally restrict the origin firewall to Cloudflare IP ranges so direct (non-CF) traffic can't reach it.