Skip to content

Commit

Permalink
[Docs] Fix unknown code block languages (#18998)
Browse files Browse the repository at this point in the history
  • Loading branch information
pedrosousa authored Jan 3, 2025
1 parent c40c223 commit 406578e
Show file tree
Hide file tree
Showing 4 changed files with 62 additions and 60 deletions.
26 changes: 15 additions & 11 deletions src/content/docs/learning-paths/mtls/mtls-app-security/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,9 @@ By default, mTLS uses Client Certificates issued by a Cloudflare Managed CA. Clo
## 1. Enable mTLS

1. Go to your Cloudflare dashboard and select your account and domain.
2. Go to **SSL/TLS** > **[Client Certificates](/ssl/client-certificates/)** tab and select **Edit** to add the Hosts (hostnames) you want to [enable mTLS](/ssl/client-certificates/enable-mtls/) for.
2. Go to **SSL/TLS** > **[Client Certificates](/ssl/client-certificates/)** tab and select **Edit** to add the Hosts (hostnames) you want to [enable mTLS](/ssl/client-certificates/enable-mtls/) for.

Example host: `mtls-test.example.com`
Example host: `mtls-test.example.com`

3. Select **Create Certificate** and fill in the required fields. You can choose one of the following options:

Expand All @@ -27,7 +27,7 @@ By default, mTLS uses Client Certificates issued by a Cloudflare Managed CA. Clo

To generate and use your own CSR, you can run a command like the following:

```txt
```sh
openssl req -new -newkey rsa:2048 -nodes -keyout client1.key -out client1.csr -subj '/C=GB/ST=London/L=London/O=Organization/CN=CommonName'
```

Expand All @@ -41,19 +41,19 @@ In order for a client to utilize the Client Certificate you created, it must be

We generally recommended using one Client Certificate per device. Configuring your system to actually use the Public and Private Certificates is especially important.

An example is to [add both certificates to the Keychain](https://support.apple.com/en-gb/guide/keychain-access/kyca2431/mac) on a MacBook laptop.
An example is to [add both certificates to the Keychain](https://support.apple.com/en-gb/guide/keychain-access/kyca2431/mac) on a MacBook laptop.

Another example is to generate a [PKCS12 (P12) certificate](https://en.wikipedia.org/wiki/PKCS_12) file and then [add it to your browser](https://www.ibm.com/docs/en/engineering-lifecycle-management-suite/lifecycle-management/7.0.2?topic=dashboards-importing-certificates-configuring-browsers):

```txt
```sh
openssl pkcs12 -export -out certificate.p12 -inkey private-cert.pem -in cert.pem
```

Use the values from the previous step.

Example using cURL command:

```cURL
```sh
curl -v --cert cert.pem --key private-cert.pem <HOSTNAME>
```

Expand All @@ -77,18 +77,22 @@ Ensure you are not using a VPN that could interfere with certificates or TLS dec

With the Public and Private Certificates in the same directory, with this cURL command, we will gain access:

```curl
```sh
curl -I --cert cert.pem --key private-cert.pem https://mtls-test.example.com/mtls-test
```

HTTP/2 200
```txt output
HTTP/2 200
server: cloudflare
```

Without the certificates, the terminal will display the following:

```curl
$ curl -I https://mtls-test.example.com/mtls-test
```sh
curl -I https://mtls-test.example.com/mtls-test
```

```txt output
HTTP/2 403
server: cloudflare
```
```
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@ This requires an active Enterprise [Account](/fundamentals/setup/accounts-and-zo

Setting up [mTLS](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) with [Cloudflare Access](/cloudflare-one/policies/access/) can help in cases where the customer:

- Already has existing Client Certificates on devices.
- Needs to protect Access applications with Bring Your Own CA (BYOCA).
- Already has existing Client Certificates on devices.
- Needs to protect Access applications with Bring Your Own CA (BYOCA).
- Needs to integrate with a Zero Trust solution.

## 1. Create a CA
Expand All @@ -25,42 +25,42 @@ In case you want to [create your own CA](/cloudflare-one/identity/devices/access

```json
{
"CN": "Cloudflare Access Testing CA",
"key": {
"algo": "rsa",
"size": 4096
},
"names": [
{
"C": "US",
"L": "LA",
"O": "Access Testing",
"OU": "CA",
"ST": "California"
}
]
}
"CN": "Cloudflare Access Testing CA",
"key": {
"algo": "rsa",
"size": 4096
},
"names": [
{
"C": "US",
"L": "LA",
"O": "Access Testing",
"OU": "CA",
"ST": "California"
}
]
}
```

2. Create a JSON file called `ca-config.json`:

```json
{
"signing": {
"default": {
"expiry": "8760h"
},
"profiles": {
"server": {
"usages": ["signing", "key encipherment", "server auth"],
"expiry": "8760h"
},
"client": {
"usages": ["signing","key encipherment","client auth"],
"expiry": "8760h"
}
}
}
"signing": {
"default": {
"expiry": "8760h"
},
"profiles": {
"server": {
"usages": ["signing", "key encipherment", "server auth"],
"expiry": "8760h"
},
"client": {
"usages": ["signing", "key encipherment", "client auth"],
"expiry": "8760h"
}
}
}
}
```

Expand Down Expand Up @@ -92,11 +92,11 @@ cfssl gencert -initca ca-csr.json | cfssljson -bare ca
}
]
}
```
```

2. Now you can run the following command to generate the Client Certificates, which will output the files `client.pem`, `client-key.pem` and `client.csr`:

```txt
```sh
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client client-csr.json | cfssljson -bare client
```

Expand All @@ -114,7 +114,7 @@ Additionally, authenticated requests also send the `Cf-Access-Jwt-Assertion\` JW

## 4. Create the self-hosted applications

Finally, the hostname you want to protect with mTLS needs to be added as a [self-hosted app](/cloudflare-one/applications/configure-apps/self-hosted-apps/) in Cloudflare Access, defining an [Access Policy](/cloudflare-one/policies/access/) which uses the action [Service Auth](/cloudflare-one/policies/access/#service-auth) and the Selector *Valid Certificate*, or simply requiring an [IdP](/cloudflare-one/identity/idp-integration/) authentication. You can also take advantage of extra requirements, such as the Common Name (CN), which expects the indicated hostname, and more [Selectors](/cloudflare-one/policies/access/#selectors). Alternatively, one can also [extend ZTNA with external authorization and serverless computing](/reference-architecture/diagrams/sase/augment-access-with-serverless/).
Finally, the hostname you want to protect with mTLS needs to be added as a [self-hosted app](/cloudflare-one/applications/configure-apps/self-hosted-apps/) in Cloudflare Access, defining an [Access Policy](/cloudflare-one/policies/access/) which uses the action [Service Auth](/cloudflare-one/policies/access/#service-auth) and the Selector _"Valid Certificate"_, or simply requiring an [IdP](/cloudflare-one/identity/idp-integration/) authentication. You can also take advantage of extra requirements, such as the "Common Name" (CN), which expects the indicated hostname, and more [Selectors](/cloudflare-one/policies/access/#selectors). Alternatively, one can also [extend ZTNA with external authorization and serverless computing](/reference-architecture/diagrams/sase/augment-access-with-serverless/).

## Demo

Expand All @@ -124,18 +124,22 @@ Make sure that you are not using any VPN that could interfere with the certifica

With the Public and Private Client Certificates in the same directory, with this cURL command, we will gain access:

```curl
```sh
curl -IXGET --cert client.pem --key client-key.pem https://mtls-access.example.com/
```

HTTP/2 200
```txt output
HTTP/2 200
server: cloudflare
```

Without the certificates, we'd see the following:
Without the certificates, we would see the following:

```curl
```sh
curl -I https://mtls-access.example.com/mtls-test
```

HTTP/2 401
```txt output
HTTP/2 401
server: cloudflare
```
```
8 changes: 1 addition & 7 deletions src/content/docs/r2/tutorials/summarize-pdf.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -218,7 +218,7 @@ To view the front-end of your application, run the following command and navigat
npm run dev
```

```output
```txt output
⛅️ wrangler 3.80.2
-------------------
Expand All @@ -239,8 +239,6 @@ When you open the URL in your browser, you will see that there is a file upload

To handle the file upload, you will first need to add the R2 binding. In the `wrangler.toml` file, add the following code:



<WranglerConfig>

```toml
Expand Down Expand Up @@ -309,8 +307,6 @@ npx wrangler queues create pdf-summarizer

Add the binding to the `wrangler.toml` file:



<WranglerConfig>

```toml title="wrangler.toml"
Expand Down Expand Up @@ -393,8 +389,6 @@ The above code does the following:

To use Workers AI, you will need to add the Workers AI binding to the `wrangler.toml` file. The `wrangler.toml` file should contain the following code:



<WranglerConfig>

```toml title="wrangler.toml"
Expand Down
2 changes: 1 addition & 1 deletion src/content/docs/workers/static-assets/binding.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ You are migrating from a Pages project where the assets directory is `dist`.
You do not want to upload the server-side Worker code nor Pages configuration files as public client-side assets.
Add the following `.assetsignore` file:

```gitignore
```txt
_worker.js
_redirects
_headers
Expand Down

0 comments on commit 406578e

Please sign in to comment.