Cloudflare.KeylessCertificate reference

KeylessCertificate

Source: src/Cloudflare/KeylessCertificate/KeylessCertificate.ts

A zone-level Keyless SSL configuration — serve TLS for a certificate whose private key stays on your own key server instead of being uploaded to Cloudflare.

You upload only the certificate (and intermediates); Cloudflare reaches out to an externally running gokeyless key server at host:port (optionally through a Cloudflare Tunnel) for every private-key operation.

Keyless SSL is an Enterprise-only feature: on zones without the entitlement, creation fails with the typed KeylessSslNotAvailable error (Cloudflare code 1067).

host, port, name, enabled, and tunnel are mutable in place; certificate and bundleMethod are create-only and trigger a replacement.

KeylessCertificate: Creating a Keyless SSL configuration

Basic key server over the public internet

const keyless = yield* Cloudflare.KeylessCertificate.KeylessCertificate("SiteKeyless", {
  zoneId: zone.zoneId,
  certificate: certPem, // PEM, private key stays on your key server
  host: "keyless.example.com",
  port: 24008,
});

Read the certificate from disk

const fs = yield* FileSystem.FileSystem;
const certificate = yield* fs.readFileString("certs/site.pem");

const keyless = yield* Cloudflare.KeylessCertificate.KeylessCertificate("SiteKeyless", {
  zoneId: zone.zoneId,
  certificate,
  host: "keyless.example.com",
});

KeylessCertificate: Reaching the key server through a Cloudflare Tunnel

const vnet = yield* Cloudflare.Tunnel.VirtualNetwork("KeylessVnet", {});

const keyless = yield* Cloudflare.KeylessCertificate.KeylessCertificate("SiteKeyless", {
  zoneId: zone.zoneId,
  certificate: certPem,
  host: "keyless.internal",
  port: 24008,
  tunnel: {
    privateIp: "10.0.0.10",
    vnetId: vnet.vnetId,
  },
});

KeylessCertificate: Rotation

// `certificate` is create-only — changing it replaces the configuration:
// the new one is created and the old one is deleted.
const keyless = yield* Cloudflare.KeylessCertificate.KeylessCertificate("SiteKeyless", {
  zoneId: zone.zoneId,
  certificate: rotatedCertPem,
  host: "keyless.example.com",
});