# Support for mTLS for Build

import DocButton from '~/components/webkit/DocButton.vue';

**Mutual Transport Layer Security (mTLS)**, also known as *Mutual Authentication*, is an authentication method that validates the digital certificate on both sides of a request: on the client side and on the Edge.

With **mTLS** activated, Azion checks the user's browser certificate and validates it with the **Trusted Certificate (Trusted CA)**, of your **Applications**.

mTLS is optional for applications using *TLS* protocols. However, it does promise a more secure TLS *handshake* and is an *Open Banking* requirement.

:::tip
You may need mTLS if your Application offers financial services and payments.
:::

## Prerequisites

It's necessary that your **Applications** is operating with the *Hypertext Transfer Protocol Secure (HTTPS)* protocol. [Azion Console](https://console.azion.com) allows you to configure **mTLS** in applications running with HTTP only (without the TLS encryption layer). However, mTLS requires an HTTPS connection to work.

Protocol options are available on your **Applications** configuration page in Azion Console.

:::note
mTLS will only be available if the service is activated. Contact our [Sales Team](https://www.azion.com/en/contact/) to activate it.
:::

<DocButton kind="secondary" href="/en/documentation/products/guides/secure/mtls/" label="go to associate mTLS certificate to domain guide" kind="secondary" size="medium" /> 

## Digital Certificate with support for mTLS (Trusted CA)

To configure **mTLS** in your **Applications**, you need a *Digital Certificate* that supports mTLS, generated by a *Third-Party Certificate Authority*. At Azion, we call this certificate **Trusted CA**.

Select or add a new *Domain* and make sure the mTLS option is enabled. Then select the previously added Trusted CA.

> Free certificates, generated internally by Azion (Azion [SAN]), don't support mTLS.

To use mTLS *Enforce* mode, you must use *Server Name Indication (SNI)* extension to the traditional TLS protocol.

Connections without SNI are connected to the default configuration, which, at the time of the TLS handshake, delivers the Azion SAN certificate.

When we have requests without SNI for a Domain with mTLS in *Enforce* mode, the connection will be interrupted before the route of your Applications is resolved.

> Make sure your Applications always use SNI on requests.

## How mTLS works at Azion

The default configuration of **mTLS** blocks accesses whose user identity can't be verified.

If your application needs special access, it is necessary to configure a permissive check (*Permissive mTLS*). Permissive checking can be configured on the *Domains* page.

You can also change and specify the *header variables* of your **mTLS** to meet Open Banking requirements. This can be done in the **Applications** configuration page, within [Azion Console](https://console.azion.com).

> The list of accepted variables is available on the [Rules Engine for Applications](/en/documentation/products/build/applications/rules-engine/) page.

## Limits

:::tip
**Increase limits** <br></br>
You can request to increase the limits based on your plan. Contact the [technical support team](/en/documentation/services/support/) to request it.
:::

### Certificates

These are the **default limits** for each Support service:

| Developer | Business | Enterprise | Mission-Critical |
| --- | --- | --- | --- |
| 100 | 100 | 100 | 1,000 |

MTLS Trusted CA digital certificates limits:

| Maximum size |
| --- |
| 1.000.000 chars |

:::tip
**Increase limits** <br></br>
You can request to increase the limits based on your plan. Contact the [technical support team](/en/documentation/services/support/) to request it.
:::