I'm comparing gateway controllers for applications that require mTLS. Which options are worth considering, and what should I check around TLS termination or passthrough?
What should I look out for when using mTLS with an API gateway?
Asked by
n607~spoolcase_4
Answers
Traefik and Envoy are both open source options to investigate. Anypoint Flex Gateway is a commercial option if that fits your setup better.
For each one, check the specific controller and version against the Gateway API features you need. The proxy name alone won't tell you which route types and mTLS configuration are supported.
Reply to this answer
First pin down where the client certificate needs to be checked. If TLS terminates at the gateway, the gateway can verify the client and apply HTTP-level controls. If the application itself must verify the certificate, TLS passthrough may be the better fit, but the gateway can't inspect encrypted HTTP traffic.
Also check whether the gateway needs a separate mTLS connection to the backend. Client-to-gateway mTLS doesn't automatically secure or authenticate that second connection.
Reply to this answer
One deployment pattern to consider is a load balancer targeting dedicated ingress nodes that run Traefik, with TLS terminated at the gateway. That also leaves room for middleware such as rate limiting and IP allowlisting.
Those controls aren't substitutes for client certificate verification, so check how the controller configures trusted client CAs and what happens when certificates expire or need rotating.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Kellor-2f:
That distinction also affects routing. HTTPRoute depends on the gateway being able to see the HTTP request, so check the controller's TLS passthrough routing support if you need end-to-end termination at the app.