​
Overview

Mutual Transport Layer Security (mTLS) is an enhanced form of the standard TLS protocol, ensuring that both servers authenticate and validate each other’s identities.

​
Enabling mTLS

To enable mTLS, follow the steps below.

1

Generate a private key and corresponding CSR

Use your preferred method to generate a private key and corresponding that meets the following requirements:

  1. The CSR uses RSA 2048 as the key algorithm.

  2. The CSR uses SHA2-256 as the hash algorithm.

  3. The Common Name (CN) attribute is assigned to your client_id.

Below is an example using OpenSSL:

openssl req \
    -new -sha256 -newkey rsa:2048 -nodes \
    -subj '/CN=[client_id]' \
    -keyout client.key -out client.req

Ensure you keep the private key secure as it will be used later in API requests.

2

Provide the CSR to Knot

Forward the CSR file to Knot and request that it be activated for your client_id. You’ll promptly receive a client certificate signed by Knot. This certificate, in conjunction with your private key, will serve as the authentication mechanism for interacting with the API.

3

Access the API over mTLS

Once you receive the client certificate signed by Knot, all the requests using your client_id will require mTLS, so you’ll need to attach the client.cert and client.key in your HTTP client.

Was this page helpful?