Install certificate using WARP

Feature availability

WARP modes	Zero Trust plans ↗
All modes	All plans

System	Availability	Minimum WARP version
Windows	✅	2023.3.381.0
macOS	✅	2023.3.381.0
Linux *	✅	2023.3.381.0
iOS	❌
Android	❌
ChromeOS	❌

^* Only supported on Debian-based systems.

The WARP client can automatically install the Cloudflare certificate (or a custom root certificate) on Windows, macOS, and Debian/Ubuntu Linux devices. On mobile devices and Red Hat-based systems, you will need to install the certificate manually.

The certificate is required if you want to apply HTTP policies to encrypted websites, display custom block pages, and more.

Install the certificate using WARP

1. (Optional) Upload a custom root certificate to Cloudflare.
2. In Zero Trust ↗, go to Settings > WARP client.
3. Enable Install CA to system certificate store.
4. Install the WARP client on the device.
5. Enroll the device in your Zero Trust organization.

If a custom certificate is not provided, WARP will install the default Cloudflare certificate in the system keychain for all users. If you uploaded a custom certificate, the WARP client will deploy your custom certificate instead of the Cloudflare certificate.

Next, verify that the certificate was successfully installed.

Important

WARP only installs the system certificate — it does not install the certificate on individual applications. You will need to manually add the certificate to applications that rely on their own certificate store.

Access the installed certificate

Windows

To access the installed certificate in Windows:

1. Open the Start menu and select Run.
2. Enter certlm.msc.
3. Go to Trusted Root Certification Authority > Certificates.

The default Cloudflare certificate is named Cloudflare for Teams ECC Certificate Authority.

The certificate is also placed in %ProgramData%\Cloudflare\installed_cert.pem for reference by scripts or tools.

macOS

To access the installed certificate in Windows:

1. Open Keychain Access.
2. In System Keychains, go to System > Certificates.
3. Open your certificate. The default Cloudflare certificate is named Cloudflare for Teams ECC Certificate Authority.
4. If the certificate is trusted by all users, Keychain Access will display This certificate is marked as trusted for all users.

Note

Certain macOS versions (such as macOS Ventura 13.5) do not allow WARP to automatically trust the certificate. To manually trust the certificate:

1. Select Trust.
2. Set When using this certificate to Always Trust.

Alternatively, you can configure your mobile device management (MDM) to automatically trust the certificate on all of your organization’s devices.

The certificate is also placed in /Library/Application Support/Cloudflare/installed_cert.pem for reference by scripts or tools.

Linux

On Linux, the certificate is stored in /usr/local/share/ca-certificates. The default Cloudflare certificate is named managed-warp.pem.

If you cannot find the certificate, run the following commands to update the system store:

1. Go to the system certificate store.

   cd /usr/local/share/ca-certificates

2. Rename the certificate, changing the file extension to .crt.

   sudo mv managed-warp.pem managed-warp.crt

3. Update your list of custom CA certificates.

   sudo update-ca-certificates

The certificate is also placed in /var/lib/cloudflare-warp/installed_cert.pem for reference by scripts or tools.

Uninstall the certificate

If the certificate was installed by the WARP client, it is automatically removed when you disable Install CA to system certificate store or uninstall WARP. WARP does not remove certificates that were installed manually (for example, certificates added to third-party applications).

To manually remove the certificate, refer to the instructions supplied by your operating system or the third-party application.