Skip to content
Cloudflare API
Start here
API Reference
Client Certificates

Create Client Certificate

client_certificates.create(ClientCertificateCreateParams**kwargs) -> ClientCertificate
POST/zones/{zone_id}/client_certificates

Create a new API Shield mTLS Client Certificate

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
SSL and Certificates Write
ParametersExpand Collapse
zone_id: str

Identifier.

maxLength32
csr: str

The Certificate Signing Request (CSR). Must be newline-encoded.

validity_days: int

The number of days the Client Certificate will be valid after the issued_on date

ReturnsExpand Collapse
class ClientCertificate: …
id: Optional[str]

Identifier.

maxLength32
certificate: Optional[str]

The Client Certificate PEM

certificate_authority: Optional[CertificateAuthority]

Certificate Authority used to issue the Client Certificate

id: Optional[str]
name: Optional[str]
common_name: Optional[str]

Common Name of the Client Certificate

country: Optional[str]

Country, provided by the CSR

csr: Optional[str]

The Certificate Signing Request (CSR). Must be newline-encoded.

expires_on: Optional[str]

Date that the Client Certificate expires

fingerprint_sha256: Optional[str]

Unique identifier of the Client Certificate

issued_on: Optional[str]

Date that the Client Certificate was issued by the Certificate Authority

location: Optional[str]

Location, provided by the CSR

organization: Optional[str]

Organization, provided by the CSR

organizational_unit: Optional[str]

Organizational Unit, provided by the CSR

serial_number: Optional[str]

The serial number on the created Client Certificate.

signature: Optional[str]

The type of hash used for the Client Certificate..

ski: Optional[str]

Subject Key Identifier

state: Optional[str]

State, provided by the CSR

status: Optional[Status]

Client Certificates may be active or revoked, and the pending_reactivation or pending_revocation represent in-progress asynchronous transitions

One of the following:
"active"
"pending_reactivation"
"pending_revocation"
"revoked"
validity_days: Optional[int]

The number of days the Client Certificate will be valid after the issued_on date

Create Client Certificate

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
client_certificate = client.client_certificates.create(
    zone_id="023e105f4ecef8ad9ca31a8372d0c353",
    csr="-----BEGIN CERTIFICATE REQUEST-----\nMIICY....\n-----END CERTIFICATE REQUEST-----",
    validity_days=3650,
)
print(client_certificate.id)
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDmDCCAoC...dhDDE\n-----END CERTIFICATE-----",
    "certificate_authority": {
      "id": "568b6b74-7b0c-4755-8840-4e3b8c24adeb",
      "name": "Cloudflare Managed CA for account"
    },
    "common_name": "Cloudflare",
    "country": "US",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICY....\n-----END CERTIFICATE REQUEST-----",
    "expires_on": "2033-02-20T23:18:00Z",
    "fingerprint_sha256": "256c24690243359fb8cf139a125bd05ebf1d968b71e4caf330718e9f5c8a89ea",
    "issued_on": "2023-02-23T23:18:00Z",
    "location": "Somewhere",
    "organization": "Organization",
    "organizational_unit": "Organizational Unit",
    "serial_number": "3bb94ff144ac567b9f75ad664b6c55f8d5e48182",
    "signature": "SHA256WithRSA",
    "ski": "8e375af1389a069a0f921f8cc8e1eb12d784b949",
    "state": "CA",
    "status": "active",
    "validity_days": 3650
  }
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDmDCCAoC...dhDDE\n-----END CERTIFICATE-----",
    "certificate_authority": {
      "id": "568b6b74-7b0c-4755-8840-4e3b8c24adeb",
      "name": "Cloudflare Managed CA for account"
    },
    "common_name": "Cloudflare",
    "country": "US",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICY....\n-----END CERTIFICATE REQUEST-----",
    "expires_on": "2033-02-20T23:18:00Z",
    "fingerprint_sha256": "256c24690243359fb8cf139a125bd05ebf1d968b71e4caf330718e9f5c8a89ea",
    "issued_on": "2023-02-23T23:18:00Z",
    "location": "Somewhere",
    "organization": "Organization",
    "organizational_unit": "Organizational Unit",
    "serial_number": "3bb94ff144ac567b9f75ad664b6c55f8d5e48182",
    "signature": "SHA256WithRSA",
    "ski": "8e375af1389a069a0f921f8cc8e1eb12d784b949",
    "state": "CA",
    "status": "active",
    "validity_days": 3650
  }
}