Mutual TLS Authentication

An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request fails with an authentication failure 4xx. Note that this value must refer to the consumer id or username attribute, and not its custom_id.

Certificate property to use as the authenticated group. Valid values are CN (Common Name) or DN (Distinguished Name). Once skip_consumer_lookup is applied, any client with a valid certificate can access the Service/API. To restrict usage to only some of the authenticated users, also add the ACL plugin (not covered here) and create allowed or denied groups of users.

List of CA Certificates strings to use as Certificate Authorities (CA) when validating a client certificate. At least one is required but you can specify as many as needed. The value of this array is comprised of primary keys (id).

Cache expiry time in seconds.

The length of time in seconds between refreshes of the revocation check status cache.

Whether to match the subject name of the client-supplied certificate against consumer’s username and/or custom_id attribute. If set to [] (the empty array), then auto-matching is disabled.

The UUID or username of the consumer to use when a trusted client certificate is presented but no consumer matches. Note that this value must refer to the consumer id or username attribute, and not its custom_id.

A string representing a host name, such as example.com.

An integer representing a port number between 0 and 65535, inclusive.

HTTP timeout threshold in milliseconds when communicating with the OCSP server or downloading CRL.

A string representing a host name, such as example.com.

An integer representing a port number between 0 and 65535, inclusive.

Controls client certificate revocation check behavior. If set to SKIP, no revocation check is performed. If set to IGNORE_CA_ERROR, the plugin respects the revocation status when either OCSP or CRL URL is set, and doesn’t fail on network issues. If set to STRICT, the plugin only treats the certificate as valid when it’s able to verify the revocation status.

Sends the distinguished names (DN) of the configured CA list in the TLS handshake message.

Skip consumer lookup once certificate is trusted against the configured CA list.