Create or obtain a private certificate authority (CA) whose certificates will be trusted by both services; generate CA key material and a self-signed CA certificate using a tool such as openssl or cfssl, storing the CA private key securely in a secrets manager
Issue a server certificate signed by your CA for the server-side service, and issue a separate client certificate signed by the same CA for the calling service; embed the Subject Alternative Name (SAN) matching the server's hostname in the server certificate
Configure the server to present its certificate and to require client certificate verification; provide the CA certificate (or bundle) as the trusted root so the server can validate client certs
Configure the client to present its certificate and private key on outbound connections, and to verify the server certificate against the same CA bundle
Test the connection with a tool that supports client certificate authentication; verify that a connection without a client certificate is rejected with a TLS handshake error, not a 401 or 403
Automate certificate rotation before expiry: issue new client and server certificates, deploy them, and revoke the old ones; maintain a CRL or OCSP responder if runtime revocation is required
Known gotchas
The CA certificate must be explicitly trusted by both sides; adding it to the system trust store is insufficient if the application uses its own trust store (e.g., Java's cacerts or a bundled CA bundle)
Certificate SANs must match the hostname used by the client; a CN-only certificate without SANs will be rejected by modern TLS implementations
If the same CA signs both client and server certificates, a compromised client certificate can be used to impersonate other clients; use separate intermediate CAs for client and server issuance if the threat model requires it
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp