在 Workers 中使用 mTLS

用于 Workers 的 mTLS 可用于向 Cloudflare 上未代理的服务发起的请求，或者用于获得对证书详细信息的可见性，并根据需要添加你自己的程序化逻辑进行进一步检查或操作。

暴露 mTLS 请求头

所有客户端证书详细信息都可在 Cloudflare Workers 的 tlsClientAuth 对象中找到。请参阅客户端证书变量以获取可用属性的完整列表。

用于返回所有请求头并获得可见性（包括客户端证书请求头）的 Cloudflare Workers 代码示例：

export default {
  async fetch(request, env, ctx) {
    const { tlsClientAuth = {} } = request.cf || {};
    const tlsHeaders = {
      'X-CERT-ISSUER-DN': tlsClientAuth.certIssuerDN,
      'X-CERT-SUBJECT-DN': tlsClientAuth.certSubjectDN,
      'X-CERT-ISSUER-DN-L': tlsClientAuth.certIssuerDNLegacy,
      'X-CERT-SUBJECT-DN-L': tlsClientAuth.certSubjectDNLegacy,
      'X-CERT-SERIAL': tlsClientAuth.certSerial,
      'X-CERT-FINGER': tlsClientAuth.certFingerprintSHA1,
      'X-CERT-VERIFY': tlsClientAuth.certVerify,
      'X-CERT-NOTBE': tlsClientAuth.certNotBefore,
      'X-CERT-NOTAF': tlsClientAuth.certNotAfter
    };

    const headers = Object.fromEntries(request.headers);
    return new Response(JSON.stringify({ ...headers, ...tlsHeaders }, null, 2), {
      headers: { 'Content-Type': 'application/json' }
    });

}
}

addEventListener('fetch', event => {
  event.respondWith(
    (async request => {
      const { tlsClientAuth = {} } = request.cf || {};
      const tlsHeaders = {
        'X-CERT-ISSUER-DN': tlsClientAuth.certIssuerDN,
        'X-CERT-SUBJECT-DN': tlsClientAuth.certSubjectDN,
        'X-CERT-ISSUER-DN-L': tlsClientAuth.certIssuerDNLegacy,
        'X-CERT-SUBJECT-DN-L': tlsClientAuth.certSubjectDNLegacy,
        'X-CERT-SERIAL': tlsClientAuth.certSerial,
        'X-CERT-FINGER': tlsClientAuth.certFingerprintSHA1,
        'X-CERT-VERIFY': tlsClientAuth.certVerify,
        'X-CERT-NOTBE': tlsClientAuth.certNotBefore,
        'X-CERT-NOTAF': tlsClientAuth.certNotAfter
      };

      const headers = Object.fromEntries(request.headers);
      return new Response(JSON.stringify({ ...headers, ...tlsHeaders }, null, 2), {
        headers: { 'Content-Type': 'application/json' }
      });
    })(event.request)
  );
});

使用带有 P12 证书的浏览器访问 mTLS 主机名时的响应将类似于以下示例：

{
  "X-CERT-ISSUER-DN": "CN=Managed CA abcdefghijklmnopq123456789,OU=www.cloudflare.com,O=Cloudflare\\, Inc.,L=San Francisco,ST=California,C=US",
  "X-CERT-SUBJECT-DN": "CN=Cloudflare,C=US",
  "X-CERT-ISSUER-DN-L": "/C=US/ST=California/L=San Francisco/O=Cloudflare, Inc./OU=www.cloudflare.com/CN=Managed CA abcdefghijklmnopq123456789",
  "X-CERT-SUBJECT-DN-L": "/C=US/CN=Cloudflare",
  "X-CERT-SERIAL": "37C52778E2F1820CC6342172A0E0ED33A4555F8B",
  "X-CERT-FINGER": "161e3a2089add0b2134ec43c9071f460e9f4b898",
  "X-CERT-NOTBE": "May 25 23:11:00 2024 GMT",
  "X-CERT-NOTAF": "May 23 23:11:00 2034 GMT"
}

这种方法对于通过 Cloudflare Workers 处理 mTLS 上的其他检查和逻辑也很有效。