Ankur Aggarwal

This commit **updates documentation** for **Cloudflare One Client** custom certificate generation, **correcting `openssl` commands** to include **RFC 5280 extensions** (`basicConstraints`, `keyUsage`) in BYOPKI CA certificates. This **resolves critical SSL errors** for devices using **Python 3.13+** with `ssl.VERIFY_X509_STRICT` when interacting with services protected by these certificates. Additionally, the commit **clarifies the scope** of the **OIDC Claims Gateway selector**, specifying its availability only for Generic OIDC integrations. These **documentation improvements** ensure users can properly configure custom certificates and understand OIDC selector limitations, **preventing common integration issues**.

This commit **updates the documentation** for **Cloudflare Gateway** to provide crucial clarifications regarding **egress host selectors**. It explicitly documents the **limitation that HTTPS DNS records are not supported** when using host selectors and details the potential **conflict with DNS Override policies**. Furthermore, the wording for the egress fallback mechanism has been refined to "default Cloudflare egress method," enhancing user understanding of how traffic is handled when host selectors are applied.

This commit **adds a new changelog entry** to the **Gateway** documentation, specifically `src/content/changelog/gateway/2026-03-24-oidc-claims-filtering-gateway-policies.mdx`. This **documentation update** announces the introduction of **OIDC Claims filtering** capabilities within **Firewall**, **Resolver**, and **Egress** policies. It informs users about a significant new feature that enhances access control and security configurations for **Gateway** policies.

This commit **enhances the documentation** for **Cloudflare One Gateway policies**, specifically detailing **OIDC claims support**. It adds new content explaining how to use OIDC claims as an **identity-based selector** in traffic policies, updating the generic OIDC IdP section to support custom claims. The update includes a new documentation partial with UI names and API examples, demonstrating the `any()` syntax for configuring these selectors. This **documentation update** improves user understanding and configuration of advanced identity-based access controls within the Cloudflare One platform.

This commit **updates the documentation** for **Cloudflare One Gateway**, specifically the `order-of-enforcement` guide found in `src/content/partials/cloudflare-one/gateway/order-of-enforcement.mdx`. It introduces new guidance on how to effectively filter **TCP SYN packets** using the **Cloudflare Network Firewall**, addressing the behavior where Gateway sends SYNs before policy evaluation. The update also **improves terminology consistency** by standardizing on 'destination server' and enhances readability by moving an **Enterprise-only prerequisite note** earlier in the document. This **documentation enhancement** provides crucial information for **Cloudflare One** customers on configuring advanced network security policies for **TCP SYN filtering**.

This commit **updates the Cloudflare One account limits documentation** to introduce **tiered limits** for **PAC files** and **proxy endpoints**. Specifically, it adds distinct limits for Enterprise (1,000 PAC files, 500 proxy endpoints) and non-Enterprise (50 PAC files, 50 proxy endpoints) accounts within the **Gateway** section of `account-limits.mdx`. This **documentation enhancement** clarifies resource allocation for different subscription tiers, replacing a previous single limit for proxy endpoints.

This commit significantly **updates the documentation** for **Cloudflare Gateway's proxy endpoints**, specifically enhancing information related to the **authorization proxy open beta**. It introduces new sections detailing **use cases, PAC files, rate limits, logging, and billing information**, alongside specific limitations for the beta program. The update also refines existing content by removing outdated use cases (M&A, analytics, BYOD) and **fixes a broken link** in the billing section of `src/content/docs/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/index.mdx`. This **documentation enhancement** provides clearer guidance and essential operational details for users leveraging Gateway's proxy capabilities.

This commit **updates the documentation** by adding a new **changelog entry** for the **Gateway** product. The entry announces the **open beta** availability of two significant features: the **Authorization Proxy** and **hosted PAC files**. This **documentation update** ensures users are informed about the upcoming general availability and can begin testing these new capabilities within the **Gateway** ecosystem. The changelog entry, located at `src/content/changelog/gateway/2026-03-04-gateway-authorization-proxy-open-beta.mdx`, was initially scheduled and then finalized.

This commit **updates the Cloudflare One documentation** to clarify the use of non-identity email addresses for background requests to **authorization proxy endpoints**. It provides essential guidance on the correct format and how to configure these emails within **HTTP policies** for secure background communications. The change specifically affects `src/content/docs/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/index.mdx`, improving user understanding for setting up these advanced features. Additionally, this **documentation update** standardizes the placeholder usage to `<your-team-name>` for consistency across the platform's guides.

This commit **expands documentation** for a known issue affecting **Cloudflare One Gateway** and **Chrome Local Network Access**. It provides a more comprehensive explanation of the problem, detailing its root cause, specific requirements related to iframes, and additional workaround options. This **documentation update** in `src/content/partials/cloudflare-one/gateway/egress-selector-chrome-issue.mdx` aims to improve user guidance and troubleshooting for customers encountering this particular browser interaction. The change enhances the support resources available for the **Cloudflare One** platform.

This commit **adds a changelog entry** to document the introduction of several new **beta protocols** for the **Gateway Protocol Detection** feature. Specifically, it announces support for IMAP, POP3, SMTP, MYSQL, RSYNC-DAEMON, LDAP, and NTP, significantly expanding the detection capabilities of the **Gateway**. This **documentation update** also clarifies the existing list of supported protocols, ensuring users have accurate information regarding the **Gateway Protocol Detection** subsystem. The work primarily serves as an announcement for a **new feature** in beta.

This commit significantly **updates the documentation** for **Cloudflare Gateway's protocol detection capabilities**, specifically within the `protocol-detection.mdx` file. It's a crucial **documentation update** that introduces **new beta protocol support** for IMAP, POP3, SMTP, MYSQL, RSYNC-DAEMON, LDAP, and NTP, clearly marking them with beta badges. Furthermore, it refines existing protocol entries by separating HTTP and HTTP2, renaming DCERPC, removing DNP3, and adding descriptive notes to enhance user understanding of network policy configurations. This ensures users have accurate and up-to-date information on supported protocols.

This commit **adds a new changelog entry** to `src/content/changelog/gateway/2025-07-24-HTTP-Inspection-on-all-ports.mdx`. This **documentation update** announces the availability of **Gateway HTTP Inspection on all ports** in open BETA. It informs users about an expanded capability for network traffic filtering within the **Gateway** product, allowing for more comprehensive security policies.

This commit **adds a new changelog entry** to notify customers about an upcoming change in the **Gateway policy enforcement order**. This **documentation update** ensures users are proactively informed about a significant future modification to how policies are applied within the **Gateway** system, allowing them to prepare for the new enforcement sequence.

This commit introduces a **documentation update** by adding a new entry to the project's changelog. It specifically announces the **availability of Gateway Protocol Detection** for users on PAYGO and Free Plans. This **maintenance** task ensures customers are informed about the expanded access to a key **Gateway** feature, improving transparency and user awareness regarding service capabilities. The update is located in `src/content/changelog/gateway/2025-05-27-Protocol-Detection-availability.mdx` and details the new offering for specific plan tiers.

This commit introduces a **new changelog entry** in `src/content/changelog/gateway/2025-04-28-FDQN-Filtering-Egress-Policies.mdx`. This **documentation update** details the implementation of **FQDN filtering** for **Gateway Egress Policies**. It serves as a **maintenance** task to inform users about a significant new capability within the **Gateway** product, enhancing network egress control and policy management.