cloudflare / cloudflare/cloudflare-docs
Incorrect documentation for the certificate posture check
- Dominant language
- MDX
- Stars
- 5.2k
- Forks
- 16.7k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 337
Description
### Existing documentation URL(s)
- https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/client-certificate/
### What changes are you suggesting?
The documentation says:
> Subject Alternative Name: (Optional) To check for a Subject Alternative Name (SAN) on the client certificate, enter a string with optional ${serial_number} and ${hostname} variables (for example, ${serial_number}_mycompany). The Cloudflare One Client will search for an exact, case-insensitive match. You can add multiple SANs to the posture check — a certificate only needs to match one SAN for the check to pass.
But from my conversation with support this is incorrect. In fact, this posture check only does a match against *some* SANs (DNS, email, etc) and not *all* SANs -- particularly *othername*. This should be called out as an explicit limitation.
### Additional information
_No response_
Contributor guide
Research direction
Open the client certificate posture-check documentation at the linked Cloudflare Developers URL and review the Subject Alternative Name section. Confirm which SAN types the posture check supports, then update the text to explicitly document that limitation, including the treatment of otherName. Done means the page no longer implies that every SAN type is checked.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 70/100