Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is mTLS?
Short answer
In normal TLS, only the server presents a certificate, and the client verifies the server's identity. With mTLS (mutual TLS), the client also presents its own certificate, and the server verifies the client's identity with this certificate; it provides certificate-based authentication instead of passwords and is used in service-to-service communication, in APIs and in internal access within an organization. In TR7, mTLS exists in two directions: Client Certificate Authentication (mTLS) in the TLS Security Profile requests a certificate from the clients that connect to the vService; Client Certificate Presented to Backend (mTLS) in the Backend Service, on the other hand, makes TR7 present its own client certificate when it connects to the Backend Service.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → TLS Security Profiles → Client Certificate Verification (mTLS) — Frontend | Client Certificate Authentication (mTLS), Client Certificate Verification Type (Required as the default, Optional), CA Certificate Files, CA Verification Error Strategy | Requesting a certificate from the clients that connect to the vService and validating the certificate against the selected CAs; the profile is selected in the SSL Security field of the HTTP or L7 TCP vService |
| Backend Service → SSL Service | Client Certificate Presented to Backend (mTLS) | TR7 presenting a client certificate when it connects to the Backend Service |
| Load Balancer → Profiles (L4-L7 Behavior Sets) → Health Checks | Client Certificate to Present (mTLS) | Presenting a client certificate to the server in a health check that uses TLS; if it is left as None, the client certificate of the Backend Service is used |
| Certificates & PKI → Client Certificates | How to Add: Issue from an internal CA, Import an existing certificate | Generating or importing a client certificate |
| Certificates & PKI → Certificate Authorities (CA) | Add a trusted CA certificate | Adding the CA that signs the client certificates, for validation |
Common Misconceptions
- "Even when Optional is selected, only clients with a certificate connect." Optional also accepts clients without a certificate and validates the certificate if one is presented; Required is selected so that only clients with a valid certificate connect.
- "The two directions of mTLS are the same setting." Requesting certificates from clients is set in the TLS Security Profile, and TR7 presenting a certificate to the Backend Service is set in the Backend Service form; one does not turn on the other.
- "A certificate completely eliminates password management." The distribution and renewal of the certificates and their protection on the clients are managed separately; the client certificates that TR7 generates on the Client Certificates screen are not renewed automatically.
How it is done in the documentation
