mTLS

In our environment we’re making extensive use of mutual TLS (mTLS), resp. client certificates.

We’ve decided to use client certificates, because:

  • We already have a PKI in place

  • Our Proxy allows us to enforce them

  • mutual TLS (mTLS) is often much easier to use than VPN’s

Get the root certificate

The root certificate can be downloaded directly from the CA.

Important

Most OS require the root certificate to be installed and trusted.

Hint

The CA is only reachable from within our networks.

Get a client certificate

To get a valid SSL client certificate you’ve 2 options:

2. Get it via Mattermost 1. Get it directly from the CertBob web UI (only from within our networks)

For Mattermost use this procedure:

  1. Login into Mattermost

  2. Enter /cert

  3. Follow the instructions

Hint

CertBob is in charge of providing employees the SSL client certificates, either directly or via Mattermost.

Install client certificate

Client certificate on macOS

The most straight-forward way to install the certificate on macOS is to:

  • Double-click the PKCS12 certificate

  • Enter the certificate passphrase

Client certificate on iOS

The most straight-forward way to install the certificate on iOS is to:

  • Send the PKCS12 certificate by e-mail to yourself

  • Open the certificate on iOS

  • Enter your iOS PIN number or password

  • Enter the certificate passphrase

  • Click on Install

Important

iOS only provides the client certificate when the root certificate is installed & trusted.

Client certificate on Android

The most straight-forward way to install the certificate on Android is to:

  • Transfer the PKCS12 certificate to your phone

  • Go to Settings -> Passwords & Security -> Privacy -> Encryption & Credentials -> Install from storage

  • Select the PKCS12 certificate to install from storage

Client certificate on Windows

When adding the certificate on Windows do this:

  • Rename the PKCS12 certificate to *.pfx

  • Double-click the PFX certificate

  • Select Current User in the welcome screen

  • Accept the file name of the certificate (should be the PFX file)

  • Enter the certificate passphrase, and accept all other default values

  • Let Windows automatically select the certificate store, based on the type of certificate

  • Finish the installation