certificates

Creates, updates, deletes, gets or lists a certificates resource.

Overview

Name	certificates
Type	Resource
Id	cloudflare.zero_trust.certificates

Fields

The following fields are returned by SELECT queries:

get

Get an mTLS certificate response

Name	Datatype	Description
id	string	The ID of the application that will use this certificate.
name	string	The name of the certificate. (example: Allow devs)
associated_hostnames	array	The hostnames of the applications that will use this certificate.
created_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)
expires_on	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)
fingerprint	string	The MD5 fingerprint of the certificate. (example: MD5 Fingerprint=1E:80:0F:7A:FD:31:55:96:DE:D5:CB:E2:F0:91:F6:91)
updated_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	certificate_id, zone_id		Fetches a single mTLS certificate.
create	insert	zone_id, name, certificate		Adds a new mTLS root certificate to Access.
edit	update	zone_id, enabled		Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.
update_by_account	replace	certificate_id, account_id, associated_hostnames		Updates a configured mTLS certificate.
update_by_zone	replace	certificate_id, zone_id, associated_hostnames		Updates a configured mTLS certificate.
delete	delete	certificate_id, zone_id		Deletes an mTLS certificate.
activate	exec	certificate_id, account_id		Bind a single Zero Trust certificate to the edge.
deactivate	exec	certificate_id, account_id		Unbind a single Zero Trust certificate from the edge.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
account_id	string	The Cloudflare account ID.
certificate_id	string	The certificate ID.
zone_id	string	The Cloudflare zone ID.

SELECT examples

get

Fetches a single mTLS certificate.

SELECT
id,
name,
associated_hostnames,
created_at,
expires_on,
fingerprint,
updated_at
FROM cloudflare.zero_trust.certificates
WHERE certificate_id = '{{ certificate_id }}' -- required
AND zone_id = '{{ zone_id }}' -- required
;

INSERT examples

create

Adds a new mTLS root certificate to Access.

INSERT INTO cloudflare.zero_trust.certificates (
associated_hostnames,
certificate,
name,
zone_id
)
SELECT 
'{{ associated_hostnames }}',
'{{ certificate }}' /* required */,
'{{ name }}' /* required */,
'{{ zone_id }}'
RETURNING
errors,
messages,
result,
success
;

Manifest

# Description fields are for documentation purposes
- name: certificates
props:
  - name: zone_id
    value: "{{ zone_id }}"
    description: Required parameter for the certificates resource.
  - name: associated_hostnames
    value:
      - "{{ associated_hostnames }}"
    description: |
      The hostnames of the applications that will use this certificate.
  - name: certificate
    value: "{{ certificate }}"
    description: |
      The certificate content.
  - name: name
    value: "{{ name }}"
    description: |
      The name of the certificate.

UPDATE examples

edit

Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.

UPDATE cloudflare.zero_trust.certificates
SET 
enabled = {{ enabled }}
WHERE 
zone_id = '{{ zone_id }}' --required
AND enabled = {{ enabled }} --required
RETURNING
errors,
messages,
result,
success;

REPLACE examples

update_by_account

Updates a configured mTLS certificate.

REPLACE cloudflare.zero_trust.certificates
SET 
associated_hostnames = '{{ associated_hostnames }}',
name = '{{ name }}'
WHERE 
certificate_id = '{{ certificate_id }}' --required
AND account_id = '{{ account_id }}' --required
AND associated_hostnames = '{{ associated_hostnames }}' --required
RETURNING
errors,
messages,
result,
success;

update_by_zone

Updates a configured mTLS certificate.

REPLACE cloudflare.zero_trust.certificates
SET 
associated_hostnames = '{{ associated_hostnames }}',
name = '{{ name }}'
WHERE 
certificate_id = '{{ certificate_id }}' --required
AND zone_id = '{{ zone_id }}' --required
AND associated_hostnames = '{{ associated_hostnames }}' --required
RETURNING
errors,
messages,
result,
success;

DELETE examples

delete

Deletes an mTLS certificate.

DELETE FROM cloudflare.zero_trust.certificates
WHERE certificate_id = '{{ certificate_id }}' --required
AND zone_id = '{{ zone_id }}' --required
;

Lifecycle Methods

activate

Bind a single Zero Trust certificate to the edge.

EXEC cloudflare.zero_trust.certificates.activate 
@certificate_id='{{ certificate_id }}' --required, 
@account_id='{{ account_id }}' --required
;

deactivate

Unbind a single Zero Trust certificate from the edge.

EXEC cloudflare.zero_trust.certificates.deactivate 
@certificate_id='{{ certificate_id }}' --required, 
@account_id='{{ account_id }}' --required
;