<![CDATA[Anybody here does mTLS?]]>There are some services that I expose to the internet (using Apache reverse proxy) that really should be accessed by only a small set of devices. Requiring client certificates seems like a great way to reduce the attack surface and prevent brute force attacks (since the attacker doesn't even get a chance to attempt a login).

I wonder about the difficulty on the client side as well as other practical implications. The clients are smartphones of various makes.

]]>https://forum.ieu.app/topic/ee36b4f6-76d2-4b6d-a291-14f7c40ecd9b/anybody-here-does-mtlsRSS for NodeSat, 05 Sep 2026 19:02:36 GMTSun, 16 Aug 2026 17:22:42 GMT60