--- title: "Mutual TLS Concepts" slug: "mutual-tls-concepts" tags: ["administration", "security"] updated: 2026-09-11T19:13:59Z published: 2026-09-15T20:09:25Z canonical: "docs.unqork.io/mutual-tls-concepts" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.unqork.io/llms.txt > Use this file to discover all available pages before exploring further. # Mutual TLS Concepts Mutual TLS (mTLS) extends the standard TLS (Transport Layer Security) protocol to require both the client and the server to authenticate with a certificate. In Unqork, mTLS secures outbound service connections to external APIs that require verified client identity beyond an API key or password. ## How Standard TLS Works TLS is the protocol that encrypts traffic between a client and a server. When a connection begins, the two sides perform a TLS handshake: the server presents its certificate, and the client verifies that the certificate is valid and signed by a trusted Certificate Authority. Once verified, the two sides agree on encryption parameters and establish a secure channel. In standard TLS, only the server authenticates. The client is anonymous—the server knows the traffic is encrypted, but has no way to verify who sent it. This model works well for public websites where any browser should be able to connect, but it's not enough when an external service must confirm the identity of the caller. ## What Mutual TLS Adds Mutual TLS extends the handshake to require the client to also present a certificate. After the server authenticates itself, it requests a certificate from the client. The client presents one, and the server verifies it before allowing the connection to proceed. Both sides have now confirmed each other's identity. Because the server explicitly configures which client certificates it trusts, a client certificate does not need to be signed by a public Certificate Authority. Self-signed certificates work, as long as the remote service owner configures their system to trust the certificate. This also means that replacing a certificate requires notifying the remote service owner so they can update their trust configuration. ## Standard TLS vs. mTLS | Function | Standard TLS | Mutual TLS (mTLS) | | --- | --- | --- | | **Who authenticates** | Server only | Server and client | | **Client certificate required** | No | Yes | | **Trust direction** | Client trusts server | Both sides trust each other | | **Common use case** | Public HTTPS websites | API integrations requiring verified client identity | | **Certificate setup** | Server-side only | Both sides need certificates | | **Self-signed certs** | Typically not trusted | Acceptable—remote server explicitly configures trust | | **Replaces API keys or passwords** | No | No—stacks on top of existing authentication | ## mTLS in Unqork Unqork uses mTLS for outbound service connections. The workflow from certificate to request: 1. A Services-type certificate in PFX format is uploaded in **Certificate Management**. Unqork extracts the certificate metadata and stores the content encrypted at rest. 2. The certificate is attached to one or more services in **Services Administration** using the **Enable Mutual TLS** toggle. Each service can be linked to only one certificate at a time. 3. When Unqork makes an outbound request to a configured service, it presents the attached certificate during the TLS handshake. 4. The external system verifies the certificate against its trust configuration and either accepts or rejects the connection. If a certificate is regenerated or replaced, the remote service owner must update their trust configuration before connections will succeed again. > See [Certificate Concepts](/unqorkai/docs/certificate-concepts) for PFX format and certificate structure details, and [Certificate Management](/unqorkai/docs/certificate-management) for the upload and attachment workflow. ### Supported Authentication Types mTLS in Unqork is configured at the service level and is compatible with most service authentication types. **Authentication types that support mTLS**: Basic Authentication, Bearer Token, OAuth2 Client Credentials Grant, OAuth2 JWT Bearer, OAuth2 Password Grant, OpenID Connect (OIDC), WSSE Username Token Profile, Custom SOAP Header, Hyperscience, No Authentication. **Authentication types that do not support mTLS**: Canada Post, Decryption (GPG), Encryption (GPG), FTP, Google Places, HMAC, Plaid, SFTP, Twilio. See [Service Types](/unqorkai/docs/service-types) for full configuration details and field descriptions for each authentication type. ## TLS (Transport Layer Security) Terminology | Term | Definition | | --- | --- | | **TLS Handshake** | The negotiation at the beginning of a TLS connection where the client and server exchange certificates and agree on encryption parameters. | | **Client Certificate** | A certificate presented by the client to prove its identity to the server during an mTLS handshake. | | **Trust Store** | A collection of certificates or Certificate Authorities that a system is configured to trust. In mTLS, the remote server's trust store must include the client's certificate or its signing CA. | | **Certificate Chain** | A sequence of certificates linking an end-entity certificate back to a trusted root CA. | | **Self-Signed Certificate** | A certificate where the issuer and the subject are the same entity, not signed by a public CA. Valid for mTLS when the remote server explicitly trusts it. | | **PFX/PKCS#12** | A binary bundle format containing a certificate, private key, and optionally the certificate chain. Unqork requires this format for mTLS certificates. | --- **Changelog** | Date | Change | | --- | --- | | 2026-04-29 | Initial publication. | Transport Layer Security (TLS) is a protocol that provides communication security across a network. APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services. A key-value pair is a fundamental data structure where a unique "key" is associated with a specific "value," used for organizing and retrieving data efficiently, like in dictionaries or databases. APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services. A key-value pair is a fundamental data structure where a unique "key" is associated with a specific "value," used for organizing and retrieving data efficiently, like in dictionaries or databases. A bearer token is an HTTP authentication scheme that allows clients to generate a cryptic string used to authorize access to server resources. A JSON Web Token (JWT) is used to identify an authenticated user. They are issued by an authentication server to secure use on aclient server. OIDC (OpenID Connect) is an identity authentication protocol that lets two applications share user information without exposing user credentials. FTP (File Transfer Protocol) supports the transfer of files between an FTP client and your server. SFTP (Secure File Transfer Protocol) supports the transfer of files between an SFTP client and your server. Unlike FTP, it uses tunneling and performs transfers using a crytographic protocol to keep files secure.