As a security measure, we ask customers to keep this record under a long, random hostname such as “”. To configure Keyless SSL, we ask customers to create a DNS record that indicates the IP address of their keyserver. In order for Cloudflare to communicate with a customer’s key server, we have to know the IP address associated with it. Strengthening the security of key servers even further

To make it easy for customers to set this up, during Security Week in 2021, we launched integrations between Keyless SSL and HSM offerings from all major cloud providers. While Keyless SSL is compatible with any hardware that support PKCS#11 standard, Keyless SSL users frequently opt to secure their private keys within HSMs (Hardware Security Modules), which are specialized machines designed to be tamper proof and resistant to to unauthorized access or manipulation, secure against attacks, and optimized to efficiently execute cryptographic operations such as signing and decryption. That was, until we built out Keyless SSL in 2014, a feature that allows customers to keep their private keys stored on their own infrastructure while continuing to make use of Cloudflare’s services. While Cloudflare adopts the strictest controls to secure these keys, certain industries such as financial or medical services may have compliance requirements that prohibit the sharing of private keys.In the past, Cloudflare required customers to upload their private key in order for us to provide our L7 services. Today, Cloudflare manages private keys for millions of domains which allows the data communicated by a client to stay secure and encrypted. Security has always been a critical aspect of online communication, especially when it comes to protecting sensitive information. Now, customers will be able to use our Cloudflare Tunnels product to send traffic to the key server through a secure channel, without publicly exposing it to the rest of the Internet. In the past, the configuration required customers to expose the location of their key server through a DNS record - something that is publicly queryable. Keyless SSL allows customers to store their private keys on their own hardware, while continuing to use Cloudflare’s proxy services. Today, we’re excited to announce a big security enhancement to our Keyless SSL offering.

Tls tunnel 2021