Enable Device Information Only

Device Information Only mode allows you to enforce device posture rules when a user connects to your self-hosted Access application. This mode relies on a client certificate generated from your account to establish trust between the Access application and the device.

To set up Device Information Only mode:

1. Enable client certificate provisioning for your zone:

   curl --request PATCH \
   "https://api.cloudflare.com/client/v4/zones/{zone_id}/devices/policy/certificates" \
   --header "X-Auth-Email: <EMAIL>" \
   --header "X-Auth-Key: <API_KEY>" \
   --header "Content-Type: application/json" \
   --data '{"enabled": true}'

2. In Zero Trust ↗, go to Settings > WARP Client.

3. In the Profile settings card, choose a device profile and select Configure.

4. For Service mode, select Device Information Only.

5. Next, enroll your device into your Zero Trust organization.

   When enrolled in Device Information Only mode, the WARP client will automatically generate a client certificate and install the certificate on the device. This certificate is necessary to confirm the source of outgoing traffic.

6. (Optional) Verify the client certificate on the device:

Windows

1. Open the Start menu and select Run.
2. Enter certlm.msc.
3. Go to Personal > Certificates.

The certificate name should match the Device ID in your WARP client Preferences.

macOS

1. Open Keychain Access.
2. Go to System > My Certificates.

The certificate name should match the Device ID in your WARP client Preferences.

7. (Optional) Verify the client certificate in your Cloudflare account:

   1. In the Cloudflare dashboard ↗, select the zone for which you enabled client certificates.
   2. Go to SSL/TLS > Client Certificates.

   The certificate name is the WARP enrollment Device ID.

8. Lastly, block traffic from devices that do not have a valid client certificate:

   1. In the Cloudflare dashboard ↗, go to SSL/TLS > Client Certificates.
   2. Under Hosts, add the domain you want to protect with device posture rules.
   3. Select Create mTLS rule.
   4. Change the URI path field to Hostname, and enter the domain you want to protect.
   5. Select Deploy. This creates a WAF custom rule that checks all requests to your domain for a valid client certificate.

Device Information Only mode is now enabled on the device. To start enforcing device posture, set up a WARP client check and add a Require device posture rule to your Access policy. When the device connects to the Access application for the first time, the browser will ask to use the client certificate installed by WARP.