mTLS

Mutual TLS adds client authentication to the normal TLS connection. The client verifies the ReportPlane server certificate, and ReportPlane verifies the client certificate against a selected Client CA.

Configure mTLS#

1. Add the issuing certificate authority under Security → Client CAs.
2. Create or edit an ingest/query client.
3. Enable mTLS and select the CA.
4. Configure the certificate identity source and optional prefix.
5. Test with a non-production certificate.

Runtime connection#

Public ingest and query hostnames are DNS-only at Cloudflare because ReportPlane must receive the original client TLS session. TLS and customer certificate validation terminate in the Go runtime.

An HTTP reverse proxy that terminates TLS before ReportPlane would remove the certificate context and break the mTLS contract unless it provided an explicitly supported secure passthrough design.

Certificate identity#

The configured identity source determines which certificate value becomes the runtime mTLS identity. Identity binding can compare that value with JWT claims or other configured identity context.

Rotation#

Issue replacement certificates before old ones expire. When rotating a CA, consider an overlap period through separate clients or supported trust configuration rather than replacing the only trusted issuer without coordination.

Troubleshooting#

• verify the client sends the full usable certificate chain;
• confirm the certificate is signed by the selected CA;
• check validity dates and key usage;
• connect to the ingest/query domain, not the proxied management origin;
• confirm the certificate identity matches the configured source/prefix;
• inspect CIDR and resource scope after TLS succeeds.