Enable Device Information Only

Feature availability

System	Availability
Windows	✅
macOS	✅
Linux	✅
iOS	✅
Android	✅
ChromeOS	✅

Device Information Only mode allows you to enforce device posture rules when a user connects to your self-hosted Access application. This mode relies on a client certificate generated from your account to establish trust between the Access application and the device.

1. Turn on account settings

Using the API, enable client certificate provisioning for your zone:

curl --request PATCH \
"https://api.cloudflare.com/client/v4/zones/{zone_id}/devices/policy/certificates" \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{"enabled": true}'

2. Configure the WARP client

1. In Zero Trust ↗, go to Settings > WARP Client.

2. Under Profile settings card, choose a device profile and select Configure.

3. For Service mode, select Device Information Only.

4. Enroll your device into your Zero Trust organization.

   When enrolled in Device Information Only mode, the WARP client will automatically generate a client certificate and install the certificate on the device. This certificate is necessary to confirm the source of outgoing traffic.

3. (Optional) Verify the client certificate

1. To view the client certificates installed on the device:

   Windows
   1. Open the Start menu and select Run.
   2. Enter certlm.msc.
   3. Go to Personal > Certificates.
   macOS
   1. Open Keychain Access.
   2. Go to System > My Certificates.
   Linux

   Open a terminal window and run the following command:

   $ certutil -L -d sql:/etc/pki/nssdb

   iOS

   Go to Settings > General > About > Certificate Trust Settings.

   Android

   The location of the client certificate may vary depending on the Android device.

   • Samsung: Go to Settings > Security > Other security settings > View security certificates.
   • Google Pixel: Go to Security > Advanced settings > Encryption & credentials > Credential storage.
   ChromeOS

   Go to Settings > Apps > Google Play Store > Manage Android Preferences > Security > Credentials.

   The client certificate name should match the Device ID in your WARP client Preferences.

2. To verify the client certificate in your Cloudflare account:

   1. In the Cloudflare dashboard ↗, select the zone for which you enabled client certificates.
   2. Go to SSL/TLS > Client Certificates.

   The certificate name is the WARP enrollment Device ID.

4. Enforce the client certificate

To block traffic from devices that do not have a valid client certificate:

1. In the Cloudflare dashboard ↗, go to SSL/TLS > Client Certificates.
2. Under Hosts, select Edit and enter the hostname of your Access application (for example, app.mycompany.com). This enables mTLS authentication for the application.
3. Select Create mTLS rule.
4. Create a WAF custom rule that checks all requests to your application for a valid client certificate:

   Field	Operator	Value	Logic	Action
   Client Certificate	equals	Off	And	Block
   Hostname	equals	app.mycompany.com

5. Select Deploy.

Device Information Only mode is now enabled on the device. To start enforcing device posture, set up a WARP client check and add a Require device posture rule to your Access policy. When the device connects to the Access application for the first time, the browser will ask to use the client certificate installed by WARP.