MtlsCertificate

Source: src/Cloudflare/MtlsCertificate/MtlsCertificate.ts

An account-level Cloudflare mTLS certificate.

Uploads a certificate to the account-level mTLS certificate store. Upload a CA certificate (ca: true) to validate client certificates (referenced by certificate-authority hostname associations and Hyperdrive caCertificateId), or a leaf certificate plus private key (ca: false) that Cloudflare presents to your origin (referenced by Worker mtls_certificate bindings and Hyperdrive mtlsCertificateId).

Certificates are immutable: there is no update API, so changing any property triggers a replacement.

Uploading Certificates

CA certificate

const ca = yield* Cloudflare.MtlsCertificate.MtlsCertificate("client-ca", {
  ca: true,
  certificates: caPem,
});

Leaf certificate with private key

const cert = yield* Cloudflare.MtlsCertificate.MtlsCertificate("origin-client-cert", {
  ca: false,
  certificates: leafPem,
  privateKey: yield* Config.redacted("ORIGIN_CLIENT_KEY"),
});

Named certificate

const ca = yield* Cloudflare.MtlsCertificate.MtlsCertificate("client-ca", {
  name: "my-client-ca",
  ca: true,
  certificates: caPem,
});

Referencing from Hyperdrive

const ca = yield* Cloudflare.MtlsCertificate.MtlsCertificate("db-ca", {
  ca: true,
  certificates: caPem,
});

const hd = yield* Cloudflare.Hyperdrive.Connection("my-db", {
  origin: { ... },
  mtls: {
    caCertificateId: ca.mtlsCertificateId,
    sslmode: "verify-full",
  },
});