mTLS and Internal Certificates: Client Certificate Authentication in ASP.NET Core and Running Your Own CA
In mTLS the client also proves its identity with a certificate and a signature made with its private key; because public CAs are dropping the client authentication EKU, you need your own internal CA with an offline root. In ASP.NET Core we set up AddCertificate with CustomRootTrust and issuer-and-CN partner mapping, and with real runs we see Kestrel's silent rejection at the TLS layer, revocation, and how Nginx forwarding the certificate in a header can be faked without the private key.
14 Nov 2026
·
14 min
·
5
