Add mTLS (Mutual TLS) Client Authentication Support for Enhanced Security
Author: seyalliusCreated Feb 14, 2026Updated Mar 7, 2026
Labelsenhancement
Why This Matters:
Currently, Casdoor supports client authentication methods like client_secret. However, these methods have limitations:
- Client secrets can be leaked, stolen, or exposed in transit.
- No built-in support for certificate-based client identity at the transport level.Adding mTLS support would enable:
Strong cryptographic client authentication using X.509 certificates.
Certificate-bound access tokens (demonstrating proof-of-possession).
Compliance with financial-grade security requirements (FAPI).
Simplified security for service-to-service communication in Kubernetes and service mesh environments.
Integration with existing PKI infrastructure.Proposed Implementation:
Add mTLS configuration options per OAuth client:
Enable/disable mTLS requirement
Allowed certificate issuer DNs or SAN entries
Option to bind tokens to client certificates (TLS client certificate binding per RFC 8705)
Support OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens (RFC 8705):
tls_client_auth - Client authentication using X.509 certificate
self_signed_tls_client_auth - For self-signed certificates
Implement certificate validation:
Validate certificate chain
Check certificate expiration
Verify certificate against allowed issuers/CN/SAN
Add metadata indicators for OAuth clients supporting mTLSUseful links:
Source: casdoor/casdoor