ClientCertificate

Source: src/Cloudflare/ClientCertificate/ClientCertificate.ts

A zone-level API Shield mTLS client certificate signed by the Cloudflare Managed CA.

You submit a Certificate Signing Request (CSR) plus a validity period; Cloudflare signs it and returns the client certificate PEM, which clients then present when connecting to API Shield mTLS-protected hostnames.

Client certificates are immutable: there is no API to change the CSR or validity, so any prop change triggers a replacement. Deleting the resource revokes the certificate — revoked certificates remain listed on the zone in revoked status but are treated as deleted by this resource.

Safety: client certificates carry no ownership markers. When there is no prior state, read scans the zone for a non-revoked certificate issued from the same CSR and reports it as Unowned, so the engine refuses to take it over unless --adopt (or adopt(true)) is set.

Issuing a client certificate

Sign a CSR with the Cloudflare Managed CA

const cert = yield* Cloudflare.ClientCertificate.ClientCertificate("ApiClient", {
  zoneId: zone.zoneId,
  csr: clientCsrPem,
  validityDays: 365,
});
// cert.certificate is the signed client certificate PEM

Read the CSR from disk

const fs = yield* FileSystem.FileSystem;
const csr = yield* fs.readFileString("certs/client.csr");

const cert = yield* Cloudflare.ClientCertificate.ClientCertificate("ApiClient", {
  zoneId: zone.zoneId,
  csr,
  validityDays: 90,
});

Rotation

// csr and validityDays are immutable — changing either replaces the
// certificate: a new one is signed and the old one is revoked.
const cert = yield* Cloudflare.ClientCertificate.ClientCertificate("ApiClient", {
  zoneId: zone.zoneId,
  csr: rotatedCsrPem,
  validityDays: 365,
});