Client mTLS

Authenticate callers with optional frontend client certificates and authorize synthetic writes using verified forwarded identity. Keep client CA and key material separate from the server, origin, and Wingman inputs.

Prerequisites at a glance

An existing server certificate and Wingman deployment, Python 3, OpenSSL 3, and a separate private synthetic client CA.

Workflow

1. Prerequisites
2. Configuration
3. Configure
4. Verify
5. Maintain
6. Remove