Mutual TLS Authentication Configuration

You are browsing documentation for an outdated plugin version.

Configuration

This plugin is compatible with DB-less mode.

Compatible protocols

The Mutual TLS Authentication plugin is compatible with the following protocols:

grpc, grpcs, http, https

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

• name or plugin

  string required

  The name of the plugin, in this case mtls-auth.

  • If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is name.
  • If using the KongPlugin object in Kubernetes, the field is plugin.

• instance_name

  string

  An optional custom name to identify an instance of the plugin, for example mtls-auth_my-service.

  The instance name shows up in Kong Manager and in Konnect, so it's useful when running the same plugin in multiple contexts, for example, on multiple services. You can also use it to access a specific plugin instance via the Kong Admin API.

  An instance name must be unique within the following context:

  • Within a workspace for Kong Gateway Enterprise
  • Within a control plane or control plane group for Konnect
  • Globally for Kong Gateway (OSS)

• service.name or service.id

  string

  The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level /plugins endpoint. Not required if using /services/{serviceName|Id}/plugins.

• route.name or route.id

  string

  The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level /plugins endpoint. Not required if using /routes/{routeName|Id}/plugins.

• enabled

  boolean default: true

  Whether this plugin will be applied.

• config

  record required
  • anonymous

    string

    An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure 4xx. Note that this value must refer to the consumer id or username attribute, and not its custom_id.

  • consumer_by

    array of type string default: username, custom_id Must be one of: username, custom_id

    Whether to match the subject name of the client-supplied certificate against consumer’s username and/or custom_id attribute. If set to [] (the empty array), then auto-matching is disabled.

  • ca_certificates

    array of type string required

    List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (id).

  • cache_ttl

    number required default: 60

    Cache expiry time in seconds.

  • skip_consumer_lookup

    boolean required default: false

    Skip consumer lookup once certificate is trusted against the configured CA list.

  • allow_partial_chain

    boolean required default: false

    Allow certificate verification with only an intermediate certificate. When this is enabled, you don’t need to upload the full chain to Kong Certificates.

  • authenticated_group_by

    string default: CN Must be one of: CN, DN

    Certificate property to use as the authenticated group. Valid values are CN (Common Name) or DN (Distinguished Name). Once skip_consumer_lookup is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL plugin (not covered here) and create allowed or denied groups of users.

  • revocation_check_mode

    string default: IGNORE_CA_ERROR Must be one of: SKIP, IGNORE_CA_ERROR, STRICT

    Known Issue: The default value IGNORE_CA_ERROR has a known issue in versions 1.5.0.0 and later.m As a workaround, manually set the value to SKIP.

    Controls client certificate revocation check behavior. Valid values are SKIP, IGNORE_CA_ERROR, or STRICT. If set to SKIP, no revocation check is performed. If set to IGNORE_CA_ERROR, the plugin respects the revocation status when either OCSP or CRL URL is set, and doesn’t fail on network issues. If set to STRICT, the plugin only treats the certificate as valid when it’s able to verify the revocation status, and a missing OCSP or CRL URL in the certificate or a failure to connect to the server results in a revoked status. If both OCSP and CRL URL are set, the plugin always checks OCSP first, and only checks the CRL URL if it can’t communicate with the OCSP server.

  • http_timeout

    number default: 30000

    HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.

  • cert_cache_ttl

    number default: 60000

    The length of time in milliseconds between refreshes of the revocation check status cache.

  • send_ca_dn

    boolean default: false

    Sends the distinguished names (DN) of the configured CA list in the TLS handshake message.

  • http_proxy_host

    string

  • http_proxy_port

    integer between: 0 65535

    The HTTP hostname or IP address of a proxy. Use this setting with http_proxy_port to access a certificate revocation list (CRL) or an OCSP server.

    Required if http_proxy_port is set.

  • https_proxy_host

    string

    The HTTPS hostname or IP address of a proxy. Use this setting with https_proxy_port to access a certificate revocation list (CRL) or an OCSP server.

    Required if https_proxy_port is set.

  • https_proxy_port

    integer between: 0 65535

    The TCP port of the HTTPS proxy.

    Required if https_proxy_host is set.