Cloudflare API | Keyless Certificates

Trust and Safety Write Trust and Safety Read Zero Trust: PII Read Zaraz Edit Zaraz Read Zaraz Admin Access: Apps and Policies Revoke Access: Apps and Policies Write Access: Apps and Policies Read Access: Apps and Policies Revoke Access: Mutual TLS Certificates Write Access: Organizations, Identity Providers, and Groups Write Zone Settings Write Zone Settings Read Zone Read DNS Read Workers Scripts Write Workers Scripts Read Zone Write Workers Routes Write Workers Routes Read Stream Write Stream Read SSL and Certificates Write SSL and Certificates Read Logs Write Logs Read Cache Purge Page Rules Write Page Rules Read Load Balancers Write Load Balancers Read Firewall Services Write Firewall Services Read DNS Write Apps Write Analytics Read Access: Apps and Policies Write Access: Apps and Policies Read

Parameters

keylessCertificateId: string

(maxLength: 32)

Identifier.

params:

KeylessCertificateGetParams

zone_id: string

(maxLength: 32)

Identifier.

Returns

KeylessCertificate

id: string

(maxLength: 32)

Keyless certificate identifier tag.

created_on: string

(format: date-time)

When the Keyless SSL was created.

enabled: boolean

Whether or not the Keyless SSL is on or off.

host: string

(format: hostname, maxLength: 253)

The keyless SSL name.

modified_on: string

(format: date-time)

When the Keyless SSL was last modified.

name: string

(maxLength: 180)

The keyless SSL name.

permissions: Array<string>

Available permissions for the Keyless SSL for the current user requesting the item.

port: number

(maxLength: 65535, default: 24008)

The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server.

status: "active" | "deleted"

Status of the Keyless SSL.

tunnel?:

Tunnel

Configuration for using Keyless SSL through a Cloudflare Tunnel

Request example

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const keylessCertificate = await client.keylessCertificates.get(
  '023e105f4ecef8ad9ca31a8372d0c353',
  { zone_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(keylessCertificate.id);

200Example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "4d2844d2ce78891c34d0b6c0535a291e",
    "created_on": "2014-01-01T05:20:00Z",
    "enabled": false,
    "host": "example.com",
    "modified_on": "2014-01-01T05:20:00Z",
    "name": "example.com Keyless SSL",
    "permissions": [
      "#ssl:read",
      "#ssl:edit"
    ],
    "port": 24008,
    "status": "active",
    "tunnel": {
      "private_ip": "10.0.0.1",
      "vnet_id": "7365377a-85a4-4390-9480-531ef7dc7a3c"
    }
  }
}

client.keylessCertificates.create(, ):

KeylessCertificate

post/zones/{zone_id}/keyless_certificates

Creates a Keyless SSL configuration that allows SSL/TLS termination without exposing private keys to Cloudflare. Keys remain on your infrastructure.

client.keylessCertificates.edit(, , ):

KeylessCertificate

patch/zones/{zone_id}/keyless_certificates/{keyless_certificate_id}

This will update attributes of a Keyless SSL. Consists of one or more of the following: host,name,port.

client.keylessCertificates.delete(, , ):

KeylessCertificateDeleteResponse

delete/zones/{zone_id}/keyless_certificates/{keyless_certificate_id}

Removes a Keyless SSL configuration. SSL connections will no longer use the keyless server for cryptographic operations.

Domain types

KeylessCertificate{…}

Tunnel{…}

Configuration for using Keyless SSL through a Cloudflare Tunnel