cloudflare / cloudflare/cloudflare-docs

Incorrect documentation for the certificate posture check

Open Beginner friendly
#33,311 1 comment 0 reactions 0 assignees View on GitHub
content:edit documentation product:cloudflare-one
Dominant language
MDX
Stars
5.2k
Forks
16.7k
Avg merge
2d 6h
Merged PRs (30d)
337

Description

### Existing documentation URL(s)

- https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/client-certificate/

### What changes are you suggesting?

The documentation says:
> Subject Alternative Name: (Optional) To check for a Subject Alternative Name (SAN) on the client certificate, enter a string with optional ${serial_number} and ${hostname} variables (for example, ${serial_number}_mycompany). The Cloudflare One Client will search for an exact, case-insensitive match. You can add multiple SANs to the posture check — a certificate only needs to match one SAN for the check to pass.

But from my conversation with support this is incorrect. In fact, this posture check only does a match against *some* SANs (DNS, email, etc) and not *all* SANs -- particularly *othername*. This should be called out as an explicit limitation.

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Open the client certificate posture-check documentation at the linked Cloudflare Developers URL and review the Subject Alternative Name section. Confirm which SAN types the posture check supports, then update the text to explicitly document that limitation, including the treatment of otherName. Done means the page no longer implies that every SAN type is checked.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
70/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.