From 88cfb7501763b7c0f9e4807b1a1f3fdd584f45bc Mon Sep 17 00:00:00 2001 From: Kenneth Johnson Date: Thu, 23 Jul 2026 10:19:25 -0500 Subject: [PATCH] [Cloudflare One] Clarify Access mTLS plan availability --- .../service-credentials/mutual-tls-authentication.mdx | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/content/docs/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication.mdx b/src/content/docs/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication.mdx index 219901d4eb3..0cf9b848ed9 100644 --- a/src/content/docs/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication.mdx +++ b/src/content/docs/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication.mdx @@ -12,6 +12,12 @@ sidebar: import { AvailableNotifications, Render, Example } from "~/components"; +:::note[Availability] +Access mTLS is available with Zero Trust contract plans. It is not included in Free, Pro, Business, or pay-as-you-go Zero Trust plans. Customers on these plans can use [service tokens](/cloudflare-one/access-controls/service-credentials/service-tokens/) to authenticate automated systems. + +This page covers Access mTLS for Service Auth policies. [Zone-level mTLS](/api-shield/security/mtls/) is a separate feature with different plan availability. +::: + [Mutual TLS (mTLS) authentication](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/) requires both the client and the server to present certificates during the TLS handshake. In the Cloudflare Access implementation, the CA you upload is used to verify the client certificate (server certificate verification is handled by standard TLS). Access mTLS serves two purposes: - **Authenticate devices that do not use an identity provider** — Automated systems and IoT devices can prove their identity by presenting a client certificate instead of logging in through an IdP.