Skip to content

Add Mutual TLS (mTLS) authentication section #28113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
patriciasantaana merged 3 commits into from
Feb 6, 2026
Merged

Add Mutual TLS (mTLS) authentication section #28113

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8c751b2
Add Mutual TLS (mTLS) authentication section
danish-m-qureshi Feb 5, 2026
d5f844d
Change Privacy Pass tokens privacy level to High
danish-m-qureshi Feb 5, 2026
9c321b7
Update src/content/docs/privacy-proxy/concepts/authentication.mdx
danish-m-qureshi Feb 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions src/content/docs/privacy-proxy/concepts/authentication.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,13 @@ Privacy Proxy requires clients to authenticate before proxying traffic. This pag

## Authentication methods

Privacy Proxy supports two authentication methods:
Privacy Proxy supports three authentication methods:

| Method | Use case | Privacy level |
| -------- | ---------- | --------------- |
| Pre-shared key (PSK) | Proof of concept, testing | Lower |
| Privacy Pass tokens | Production deployments | Higher |
| Privacy Pass tokens | Client to server | High |
| mTLS | Server to server | Higher |
Copy link
Member

@RageKnify RageKnify Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be High to match "Privacy Pass tokens"


---

Expand Down Expand Up @@ -134,6 +135,22 @@ For production deployments using Privacy Pass:

---

## Mutual TLS (mTLS)

[Mutual TLS (mTLS) authentication](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/) ensures that traffic is both secure and trusted in both directions. The client presents a certificate to the proxy, and the proxy validates it before allowing the connection.

### How it works

The client includes a TLS client certificate during the TLS handshake. The proxy validates the certificate against a configured certificate authority (CA) and allows the connection if the certificate is trusted.

### Limitations

You must provision and manage certificates for each client or service. mTLS is designed for server-to-server communication, not for authenticating individual users. The proxy can identify the client by its certificate, which reduces privacy compared to Privacy Pass.

Use mTLS for server-to-server integrations where both parties are trusted services.

---

## Authentication in double-hop deployments

In [double-hop deployments](/privacy-proxy/concepts/deployment-models/#double-hop), authentication occurs at two levels:
Expand Down
Loading