User-side certificates
Advanced security features such as HTTPS traffic inspection, Data Loss Prevention, anti-virus scanning, Access for Infrastructure, and Browser Isolation require users to install and trust a root certificate on their device. You can either install the certificate provided by Cloudflare (default option), or generate your own custom certificate and upload it to Cloudflare.
Gateway generates a unique root CA for each Zero Trust account and deploys it across the Cloudflare global network. Alternatively, Enterprise users can upload and deploy their own custom certificate.
Zero Trust will indicate if a certificate is ready for use in inspection based on its deployment status:
| Deployment status | Description |
|---|---|
| Inactive | The certificate has been generated by or uploaded to Cloudflare but is not deployed across the global network. |
| Pending | The certificate is being activated or deactivated for use. |
| Active | The certificate is deployed across the Cloudflare global network and ready to be turned on. |
| Active and In-Use | The certificate is turned on. Gateway will use the certificate for inspection. |
To generate a new Cloudflare root certificate for your Zero Trust organization:
- In Zero Trust ↗, go to Settings > Resources.
- In Certificates, select Manage.
- Select Generate certificate.
- Choose a duration of time before the certificate expires. Cloudflare recommends expiration after five years. Alternatively, choose Custom and enter a custom amount in days.
- Select Generate certificate.
The certificate will appear in your list of certificates as Inactive. To download a generated certificate, select it, then choose Download .pem and/or Download .crt. To deploy your certificate and turn it on for inspection, you need to activate the certificate.
Each Zero Trust account can generate a new root certificate a maximum of three times per day.
Once a certificate is generated in or uploaded to Zero Trust, you need to activate it. Activating a certificate deploys it across the Cloudflare network. You can have up to 25 active certificates at once.
To activate your root certificate:
- In Zero Trust ↗, go to Settings > Resources.
- In Certificates, select Manage.
- Select the certificate you want to activate.
- Select Activate.
The status of the certificate will change to Pending while it deploys. Once the status of your certificate is Active, you can install it on your user's devices either with WARP or manually.
Once you deploy and install your certificate, you can turn it on for use in inspection:
- In Zero Trust ↗, go to Settings > Resources.
- In Certificates, select Manage.
- Select the certificate you want to turn on.
- In Basic information, select Confirm and turn on certificate.
You can set multiple certificates to Active, but you can only turn on one certificate for use in inspection at a time. Setting a certificate as In-Use will set any other turned on certificates as Active and prevent them from being used for inspection until turned on again.