The service may be configured to require and validate client certificates during the TLS handshake, rejecting connections from clients that do not present a certificate issued by a trusted authority.
Mutual TLS Client Authentication
CCC.LB.CP26
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH10 | Client Certificate Validation Is Bypassed | Mutual TLS may be configured in passthrough mode, with a trust store that contains untrusted certificate authorities, or without revocation checking. Clients that present no certificate or a revoked one are then forwarded to backend targets as if authenticated, compromising the confidentiality and integrity of the resources behind the load balancer. |