mTLS

mTLS is a mechanism for ensuring that both the client and server authenticate each other over a TLS connection. It is an extension of standard TLS (which typically only authenticates the server to the client).

How mTLS Works

• Client Authentication: In addition to the server presenting its certificate, the client also presents its own certificate to the server.
• Certificate Verification: Both parties verify the certificates they receive. This ensures that both the client and server are who they claim to be, providing bidirectional authentication.
• Secure Communication: Once both parties are authenticated, a secure encrypted communication channel is established.

Benefits of mTLS

• Strong, cryptographic client authentication.
• Prevents unauthorized clients from connecting to the server.
• Ensures data integrity and confidentiality during transmission.

Setup

Setting up mTLS requires two steps. Please contact us for:

• Enabling your API Client for mTLS
• Sharing your certificates in order to be added to our PKI infrastructure

Certificate Requirements

• Certificates must use either RSA or ECDSA ciphers.

• For client (leaf) certificates:

  • The BasicConstraints extension must not contain CA=true
  • The ExtendedKeyUsage extension must contain clientAuth
  • The ExtendedKeyUsage extension must not contain the codeSigning, timeStamping, or OCSPSigning fields
  • The certificate must not be expired
  • The client certificate cannot be a self-signed certificate

• For root and intermediate certificates:

  • The BasicConstraints extension must contain CA=true
  • The KeyUsage extension must be set to keyCertSign
  • The ExtendedKeyUsage extension should contain the clientAuth field
  • The certificate must not be expired