Document untrusted origin certificate handling for private hostname routing

[josip-stanic]

Summary

Documents existing Gateway behavior for private hostname applications whose origin presents a certificate that is not issued by a publicly trusted certificate authority, such as a self-signed certificate or one issued by an internal CA.

With Gateway TLS decryption turned on, Gateway cannot validate the certificate and the connection fails with Error 526. The remedy is a Gateway HTTP Allow policy matching the application, with the untrusted certificate action set to Pass through.

This is already documented on the Access self-hosted private app page, but not on the private hostname routing page, which is where users configure the tunnel and are most likely to encounter the failure first.

What changed

A note at the end of step 3 explains the 526 and its remedy, and covers the interaction with Access self-hosted applications over HTTPS on port 443, where the browser-based login flow depends on TLS decryption.

A troubleshooting item under step 4 gives the symptom an entry point alongside the existing DNS resolution, Gateway log, tunnel status, and connectivity checks.

[cloudflare-docs-bot]

Review

✅ No issues found in commit f3737bd.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

_{No code review issues found.}

Conventions

_{No convention issues found.}

Style Guide Review

_{No style-guide issues found.}

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

[nikitacano]

The same applies to Cloudflare Mesh, right? If so, we should add this to Mesh docs too.

[josip-stanic]

The same applies to Cloudflare Mesh, right? If so, we should add this to Mesh docs too.

Yes but the Mesh routes doc (https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/routes/#secure-hostname-traffic) currently defers to '#3-recommended-filter-network-traffic-with-gateway' in this doc though. Do we want to keep the reference from Mesh Route doc to Cloudflared?