# Support for mTLS for Secure

import DocButton from '~/components/webkit/DocButton.vue';

**Mutual Transport Layer Security (mTLS)**, also known as *Mutual Authentication*, is an authentication method that validates the digital certificate on both sides of a request: on the client side and on the Edge.

With **mTLS** activated, Azion checks the user's browser certificate and validates it with the **Trusted Certificate (Trusted CA)**, of your **Application**.

mTLS is optional for applications using *TLS* protocols. However, it does promise a more secure TLS *handshake* and is an *Open Banking* requirement.

:::tip
You may need mTLS if your Application offers financial services and payments.
:::

## Prerequisites

It's necessary that your **Application** is operating with the *Hypertext Transfer Protocol Secure (HTTPS)* protocol. [Azion Console](https://console.azion.com) allows you to configure **mTLS** in applications running with HTTP only (without the TLS encryption layer). However, mTLS requires an HTTPS connection to work.

Protocol options are available on your **Application** configuration page in Azion Console.

:::note
mTLS will only be available if the service is activated. Contact our [Sales Team](https://www.azion.com/en/contact/) to activate it.
:::

<DocButton href="/en/documentation/products/guides/secure/mtls/" label="go to associate mTLS certificate to domain guide" kind="secondary" size="medium" /> 

## Digital Certificate with support for mTLS (Trusted CA)

To configure **mTLS** in your **Application**, you need a *Digital Certificate* that supports mTLS, generated by a *Third-Party Certificate Authority*. At Azion, we call this certificate **Trusted CA**.

Select or add a new *Domain* and make sure the mTLS option is enabled. Then select the previously added Trusted CA.

> Free certificates, generated internally by Azion (Azion [SAN]), don't support mTLS.

To use mTLS *Enforce* mode, you must use *Server Name Indication (SNI)* extension to the traditional TLS protocol.

Connections without SNI are connected to the default configuration, which, at the time of the TLS handshake, delivers the Azion SAN certificate.

When we have requests without SNI for a Domain with mTLS in *Enforce* mode, the connection will be interrupted before the route of your Application is resolved.

> Make sure your Applications always use SNI on requests.

## How mTLS works at Azion

The default configuration of **mTLS** blocks accesses whose user identity can't be verified.

If your application needs special access, it is necessary to configure a permissive check (*Permissive mTLS*). Permissive checking can be configured on the *Domains* page.

In **Permissive** mode, you can use the [**Client Certificate Validation**](/en/documentation/products/secure/firewall/rules-engine/) variable in the **Rules Engine for Firewall** to restrict access based on client certificate identity. This variable evaluates whether the client certificate presented in the request is valid against the configured Trusted CA. A common pattern is to deny requests where `Client Certificate Validation` is not equal to `true`, returning a `403 Forbidden` response.

<DocButton href="/en/documentation/products/guides/mtls/#adding-specific-rules-for-using-permissive-mtls" label="go to configuring Permissive mTLS rules guide" kind="secondary" size="medium" />

You can also change and specify the *header variables* of your **mTLS** to meet Open Banking requirements. This can be done in the **Application** configuration page, within [Azion Console](https://console.azion.com).

> The list of accepted variables is available on the [Rules Engine for Application](/en/documentation/products/build/applications/rules-engine/) page.

### Client Certificate Validation in Firewall

After enabling mTLS at the domain level, you can use **Firewall** to enforce granular access control based on client certificate attributes. This allows you to restrict access to specific resources based on certificate fields such as the Common Name (CN), issuer, or fingerprint forwarded via mTLS header variables.

To configure client certificate validation in Firewall:

1. Access [Azion Console](https://console.azion.com) and open your **Firewall** configuration.
2. In the **Rules Engine** tab, create a new rule.
3. In the **Criteria** section, use the mTLS header variables (such as `${ssl_client_s_dn}` or `${ssl_client_fingerprint}`) as match conditions.
4. In the **Behavior** section, set the action to **Deny (403 Forbidden)** or **Drop (Close Without Response)** for requests that don't match the expected certificate attributes.

:::note
The mTLS header variables must be configured in your **Applications** settings before they can be used as criteria in Firewall rules. See the [Rules Engine for Applications](/en/documentation/products/build/applications/rules-engine/) page for the full list of accepted variables.
:::

## Limits

:::tip
**Increase limits** <br></br>
You can request to increase the limits based on your plan. Contact the [technical support team](/en/documentation/services/support/) to request it.
:::

### Certificates

These are the **default limits** for each Support service:

| Developer | Business | Enterprise | Mission-Critical |
| --- | --- | --- | --- |
| 100 | 100 | 100 | 1,000 |

:::tip
**Increase limits** <br></br>
You can request to increase the limits based on your plan. Contact the [technical support team](/en/documentation/services/support/) to request it.
:::