Security & mTLS

Global mTLS

• Enable/disable globally via Security Hub; stores CA path and middleware defaults in DB.
• Adds TLS option mtls-verify with clientAuth pointing to your CA.

Per-resource mTLS

• Toggle mTLS on a resource to inject a per-resource mtlswhitelist middleware and set router tls.options=mtls-verify.
• Optional per-resource overrides:
  • Rules (allowlist)
  • Request headers to inject
  • Reject message/code
  • Refresh interval
  • External data payload

Certificates

• Create CA, issue client certs, revoke/delete from the Security Hub.
• Download P12 bundles per client.

Plugin requirement

• The mtlswhitelist Traefik plugin must be installed (see Plugin Hub) and present in static config.
• TRAEFIK_STATIC_CONFIG_PATH must be correct for plugin detection.