Cloudflare API | Client Certificates › Create Client Certificate

curl https://api.cloudflare.com/client/v4/zones/$ZONE_ID/client_certificates \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -d '{
          "csr": "-----BEGIN CERTIFICATE REQUEST-----\\\\nMIICY....\\\\n-----END CERTIFICATE REQUEST-----\\\\n",
          "validity_days": 3650
        }'

200Example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "certificate": "-----BEGIN CERTIFICATE-----\\nMIIDmDCCAoC...dhDDE\\n-----END CERTIFICATE-----",
    "certificate_authority": {
      "id": "568b6b74-7b0c-4755-8840-4e3b8c24adeb",
      "name": "Cloudflare Managed CA for account"
    },
    "common_name": "Cloudflare",
    "country": "US",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\\nMIICY....\\n-----END CERTIFICATE REQUEST-----\\n",
    "expires_on": "2033-02-20T23:18:00Z",
    "fingerprint_sha256": "256c24690243359fb8cf139a125bd05ebf1d968b71e4caf330718e9f5c8a89ea",
    "issued_on": "2023-02-23T23:18:00Z",
    "location": "Somewhere",
    "organization": "Organization",
    "organizational_unit": "Organizational Unit",
    "serial_number": "3bb94ff144ac567b9f75ad664b6c55f8d5e48182",
    "signature": "SHA256WithRSA",
    "ski": "8e375af1389a069a0f921f8cc8e1eb12d784b949",
    "state": "CA",
    "status": "active",
    "validity_days": 3650
  }
}

Reactivate Client Certificate -> Envelope<

ClientCertificate

patch/zones/{zone_id}/client_certificates/{client_certificate_id}

If a API Shield mTLS Client Certificate is in a pending_revocation state, you may reactivate it with this endpoint.

Revoke Client Certificate -> Envelope<

ClientCertificate

delete/zones/{zone_id}/client_certificates/{client_certificate_id}

Set a API Shield mTLS Client Certificate to pending_revocation status for processing to revoked status.

Domain types

ClientCertificate = { id, certificate, certificate_authority, 15 more... }