Install a certificate using the WARP client

The WARP client can automatically install the Cloudflare certificate (or a custom root certificate) on devices enrolled in your Zero Trust organization. The certificate is required if you want to apply HTTP policies to encrypted websites, display custom block pages, and more.

​​ Supported platforms

This feature is available on Windows, macOS, and Linux. On mobile devices, you will need to install the certificate manually.

​​ Install the certificate using WARP

1. (Optional) Upload a custom root certificate to Cloudflare.
2. In Zero Trust Open external link , go to Settings > WARP client.
3. Enable Install CA to system certificate store.
4. Install the WARP client on the device.
5. Enroll the device in your Zero Trust organization.

If a custom certificate is not provided, WARP will install the default Cloudflare certificate in the system keychain for all users. If you uploaded a custom certificate, the WARP client will deploy your custom certificate instead of the Cloudflare certificate.

​​ View the installed certificate

​​ Windows

1. Open the Start menu and select Run.
2. Enter certlm.msc.
3. Go to Trusted Root Certification Authority > Certificates.

The default Cloudflare certificate is named Cloudflare for Teams ECC Certificate Authority.

​​ macOS

1. Open Keychain Access.
2. Go to System > Certificates.

The default Cloudflare certificate is named Cloudflare for Teams ECC Certificate Authority.

​​ Linux

On Linux, the certificate is stored in /usr/local/share/ca-certificates. The default Cloudflare certificate is named Cloudflare_CA.crt.

If you do not see the certificate, run the following command to update the system store:

$ update-ca-certificates

​​ Uninstall the certificate

If the certificate was installed by the WARP client, it is automatically removed when you disable Install CA to system certificate store or uninstall WARP. WARP does not remove certificates that were installed manually (for example, certificates added to third-party applications).

To manually remove the certificate, refer to the instructions supplied by your operating system or the third-party application.