Module mtls 

mTLS client certificate authentication.

Extracts client identity from X.509 certificate Common Name (CN) or Subject Alternative Name (SAN) fields.

Certificate Revocation

CRL/OCSP checking is not implemented in Chronix — revocation is an infrastructure concern. Use short-lived certificates (≤ 24 h TTL), a service-mesh sidecar with CRL enforcement, or a reverse proxy with ssl_crl. See docs/security.md for recommended approaches.

Structs

CertificateIdentity

Client identity extracted and verified from a TLS certificate.

MtlsConfig

mTLS certificate validation configuration.

MtlsValidator

mTLS validator that extracts identity from client certificates.

Enums

CertIdentitySource

How the certificate identity was determined.