Mutual TLS Concepts

Mutual TLS (mTLS) extends the standard TLS (Transport Layer Security) protocol to require both the client and the server to authenticate with a certificate. In Unqork, mTLS secures outbound service connections to external APIs that require verified client identity beyond an API key or password.

How Standard TLS Works

TLS is the protocol that encrypts traffic between a client and a server. When a connection begins, the two sides perform a TLS handshake: the server presents its certificate, and the client verifies that the certificate is valid and signed by a trusted Certificate Authority. Once verified, the two sides agree on encryption parameters and establish a secure channel.

In standard TLS, only the server authenticates. The client is anonymous—the server knows the traffic is encrypted, but has no way to verify who sent it. This model works well for public websites where any browser should be able to connect, but it's not enough when an external service must confirm the identity of the caller.

What Mutual TLS Adds

Mutual TLS extends the handshake to require the client to also present a certificate. After the server authenticates itself, it requests a certificate from the client. The client presents one, and the server verifies it before allowing the connection to proceed. Both sides have now confirmed each other's identity.

Because the server explicitly configures which client certificates it trusts, a client certificate does not need to be signed by a public Certificate Authority. Self-signed certificates work, as long as the remote service owner configures their system to trust the certificate. This also means that replacing a certificate requires notifying the remote service owner so they can update their trust configuration.

Standard TLS vs. mTLS

mTLS in Unqork

Unqork uses mTLS for outbound service connections. The workflow from certificate to request:

1. A Services-type certificate in PFX format is uploaded in Certificate Management. Unqork extracts the certificate metadata and stores the content encrypted at rest.
2. The certificate is attached to one or more services in Services Administration using the Enable Mutual TLS toggle. Each service can be linked to only one certificate at a time.
3. When Unqork makes an outbound request to a configured service, it presents the attached certificate during the TLS handshake.
4. The external system verifies the certificate against its trust configuration and either accepts or rejects the connection.

If a certificate is regenerated or replaced, the remote service owner must update their trust configuration before connections will succeed again.

See Certificate Concepts for PFX format and certificate structure details, and Certificate Management for the upload and attachment workflow.

Supported Authentication Types

mTLS in Unqork is configured at the service level and is compatible with most service authentication types.

Authentication types that support mTLS:

Basic Authentication, Bearer Token, OAuth2 Client Credentials Grant, OAuth2 JWT Bearer, OAuth2 Password Grant, OpenID Connect (OIDC), WSSE Username Token Profile, Custom SOAP Header, Hyperscience, No Authentication.

Authentication types that do not support mTLS:

Canada POST, Decryption (GPG), Encryption (GPG), FTP, Google Places, HMAC, Plaid, SFTP, Twilio.

See Service Types for full configuration details and field descriptions for each authentication type.

TLS (Transport Layer Security) Terminology