From 7397f72df26ef3e6a126258e527cf127a1a76200 Mon Sep 17 00:00:00 2001
From: Jihun Kim <shblue21@naver.com>
Date: Thu, 6 Aug 2026 01:20:21 +0900
Subject: [PATCH] [SSL/TLS] Fix mTLS debugging Worker example

---
 .../client-certificates/troubleshooting.mdx   | 30 +++++++++++++------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/src/content/docs/ssl/client-certificates/troubleshooting.mdx b/src/content/docs/ssl/client-certificates/troubleshooting.mdx
index 7d0648795f3..a3050c13b6d 100644
--- a/src/content/docs/ssl/client-certificates/troubleshooting.mdx
+++ b/src/content/docs/ssl/client-certificates/troubleshooting.mdx
@@ -13,7 +13,7 @@ tags:
   - mTLS
 ---
 
-import { DashButton } from "~/components";
+import { DashButton, Steps, TypeScriptExample } from "~/components";
 
 If your query returns an error even after configuring and embedding a client SSL certificate, check the following settings.
 
@@ -69,25 +69,37 @@ To review mTLS rules, consider the steps below. For further guidance refer to [C
 
 You can use [Cloudflare Workers](/workers/) to debug client certificate validation failures.
 
-1. Create a Worker to debug print [cf.properties](/workers/runtime-apis/request/#incomingrequestcfproperties):
+:::caution
+Do not enable `global_fetch_strictly_public` for this Worker. When enabled, `fetch(request)` can invoke the Worker again instead of reaching the origin.
+:::
+
+<Steps>
+
+1. Create a Worker that logs [incoming request `cf` properties](/workers/runtime-apis/request/#incomingrequestcfproperties) and forwards each request to your origin:
 
-   ```js
+   <TypeScriptExample filename="src/index.ts">
+
+   ```ts
    export default {
-     async fetch(request, env, ctx) {
+     async fetch(request): Promise<Response> {
        console.info({ message: JSON.stringify(request.cf, null, 2) });
-       return new Response(JSON.stringify(request.cf, null, 2))
-     }
-   };
+       return fetch(request);
+     },
+   } satisfies ExportedHandler;
    ```
 
-2. Associate the Worker with the hostname where mTLS is enabled using a [Worker route](/workers/configuration/routing/routes/) or a [Custom Domain](/workers/configuration/routing/custom-domains/).
+   </TypeScriptExample>
+
+2. Associate the Worker with the hostname where mTLS is enabled using a [Worker route](/workers/configuration/routing/routes/).
 
 3. Make requests to the hostname and/or path configured, with and without sending the mTLS client certificate.
 
-4. View your logs on the [Observability](/workers/observability/) dashboard and compare the responses against the expected values listed below.
+4. In the [Observability](/workers/observability/) dashboard, compare the logged `tlsClientAuth` values with the expected values.
 
 	 <DashButton url="/?to=/:account/workers-and-pages/observability" />
 
+</Steps>
+
 - Valid certificate
 
    ```json