Mutual Transport Layer Security (mTLS) ensures the authenticity of both parties in a network connection. Unlike traditional one-way SSL/TLS, where only the client verifies the server, mTLS requires both parties to verify each other before a secure connection is established. Atomile allows you to upload private CA certificates to implement mTLS between the CDN and your client, helping prevent impersonation attacks and data theft.

How mTLS Works

The mTLS process enhances traditional SSL/TLS authentication:

1. Certificate Exchange - Both the client and the server exchange digital certificates containing public key and identity information.
2. Identity Verification - Each party verifies the other party’s certificate using the appropriate trust chain.
3. Secure Connection Establishment - The communication channel is established only after successful mutual authentication.

Atomile supports both authentication methods in the CDN console:

• One-way Authentication (Client Authenticates Server) - Upload your server certificate file, including the public key and private key, and associate it with your domain. For details about certificate management, see Manage SSL/TLS Certificates.
• Two-way Authentication (Server Authenticates Client) - In addition to one-way authentication, upload your private CA certificate and associate it with your domain. During authentication, CDN nodes use this CA certificate to verify the client’s certificate.

Uploading a CA Certificate

1. Log in to the Atomile Console.
2. Navigate to Certificate MGMT > CA Certificates > My Certificates.
3. Click Upload Certificate. This option is also available on the certificate Overview page.
4. Select the certificate type:
   • Root CA
   • Subordinate CA (requires you to specify the parent root CA certificate)
5. Enter a CA Name to identify and manage the certificate.
6. In CA Content, either:
   • Import the certificate file, or
   • Copy and paste the certificate content directly. The system automatically parses the content.
7. Click Next to process the certificate.

Associating a CA Certificate with Your Domain

1. In My Certificates, select the uploaded CA certificate.
2. Click Associate Domain.
3. Select the checkbox next to the domain or domains you want to associate with the certificate.
4. Click Deploy Now to complete the deployment.

Managing CA Certificates

Modifying a Certificate

1. Navigate to Certificate Management > CA Certificates > My Certificates.
2. Find your certificate and click Edit in the operation column.
3. Update any of the following:
   • CA certificate name
   • A new certificate file
   • Modified certificate content
   • Remarks
4. Click Next to save your changes.

Deleting a Certificate

1. Locate the certificate in the certificate list.
2. Click Delete in the operation column.
3. Confirm the deletion by clicking Next in the confirmation dialog.

Important Notes:

• You can delete a certificate only if it has no subordinate certificates and is not associated with any domains.
• To disassociate a domain from a certificate, use the CA Certificates > My Deployment list.
• Certificate deletion is irreversible, so proceed with caution.

Configuring mTLS Mutual Authentication

1. Navigate to Configuration, locate your domain, and click Edit Configuration or Edit.

2. Find HTTP Protocol Optimization > Client mTLS Mutual Authentication.

3. Select one of the following four authentication modes:

   • Strict Authentication - The CDN edge server verifies both the validity of the client certificate and the trustworthiness of the CA. If verification fails, the connection is rejected. A CA certificate associated with the domain is required.
   • Only Authenticate Client Certificate and CA - Verifies both the certificate validity and CA trustworthiness. If verification fails, the connection is still allowed. A CA certificate associated with the domain is recommended.
   • Only Authenticate Client Certificate - Verifies only the client certificate validity without validating the CA. If verification fails, the connection is still allowed. A CA certificate associated with the domain is recommended.
   • Disable Authentication - No client certificate verification is performed. No CA certificate association is required.

4. Click Next to submit the settings.

5. Conduct a Pre-deploy test in a staging environment. This is recommended to prevent service disruption.

6. After verification, click Deploy Now to apply the settings to the production environment. The settings usually take effect within 3 to 5 minutes.