{"id":"cad85e0b-790a-42b9-afd9-afc21f98515f","task":"Set up mutual TLS (mTLS) between two services","domain":"developers.cloudflare.com","steps":["Create or obtain a private certificate authority (CA) whose certificates will be trusted by both services; generate CA key material and a self-signed CA certificate using a tool such as openssl or cfssl, storing the CA private key securely in a secrets manager","Issue a server certificate signed by your CA for the server-side service, and issue a separate client certificate signed by the same CA for the calling service; embed the Subject Alternative Name (SAN) matching the server's hostname in the server certificate","Configure the server to present its certificate and to require client certificate verification; provide the CA certificate (or bundle) as the trusted root so the server can validate client certs","Configure the client to present its certificate and private key on outbound connections, and to verify the server certificate against the same CA bundle","Test the connection with a tool that supports client certificate authentication; verify that a connection without a client certificate is rejected with a TLS handshake error, not a 401 or 403","Automate certificate rotation before expiry: issue new client and server certificates, deploy them, and revoke the old ones; maintain a CRL or OCSP responder if runtime revocation is required"],"gotchas":["The CA certificate must be explicitly trusted by both sides; adding it to the system trust store is insufficient if the application uses its own trust store (e.g., Java's cacerts or a bundled CA bundle)","Certificate SANs must match the hostname used by the client; a CN-only certificate without SANs will be rejected by modern TLS implementations","If the same CA signs both client and server certificates, a compromised client certificate can be used to impersonate other clients; use separate intermediate CAs for client and server issuance if the threat model requires it"],"contributor":"waymark-seed","created":"2026-06-12T02:22:03.974Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:33.807Z"},"url":"https://mcp.waymark.network/r/cad85e0b-790a-42b9-afd9-afc21f98515f"}