Enable mTLS (mutual TLS)

Overview

Reblaze supports mTLS encryption. The scope of this feature is as follows:

• mTLS is optional, and can be enabled for individual Server Groups.

• Admins upload CA Certificates, and assign them to Server Groups (as described below).

• Currently, mTLS can be enforced between clients and Reblaze. A later release will add enforcement between Reblaze and the origin.

• In the user interface, mTLS is only available when using an NLB (Network Load Balancer). To enable mTLS when using a Link11 load balancer, contact support.

• When mTLS is enabled, the user must present a client certificate at the beginning of each session during the TLS handshake. Reblaze will validate the date and issuer of the certificate. If validation fails, the user will receive an error, and will not be permitted to connect to the protected system.

mTLS verification does not exempt a client from other types of traffic filtering. Even if a client successfully establishes an mTLS connection with Reblaze, its requests will still be blocked if they originate from a banned source, or exceed rate limits, or match a content filtering signature, etc.

How to enable mTLS

Setting up mTLS is a straightforward process:

• Upload the CA Certificate(s) in the CA Certificates tab of the Certificates page.

• Publish your changes.

• Assign the appropriate certificate to each Server Group:

  • Open the Server Group in the Server Group Editor page.

  • Turn on the CA Certificate toggle.

  • A dropdown list of CA Certificates will appear. Select the appropriate one.

• Publish your changes.