Enforce mTLS on Agent API #7

New Issue

2026-02-16T14:29:35Z

boris commented

2026-02-16 14:29:35 +00:00

As a platform security engineer I want all /api/v1/agent/* routes to require validated client certificates in order for me to ensure only enrolled agents can call agent endpoints.

Acceptance Criteria:

Within 10 calendar days, nginx is configured to require client certs for /api/v1/agent/* except /api/v1/agent/enroll.
Within 10 calendar days, backend rejects calls when client cert fingerprint does not match the enrolled server record with HTTP 403.
Integration tests verify: no cert fails, valid cert succeeds, mismatched cert fails.
100% of agent endpoints return 401/403 when called without valid agent identity.

As a platform security engineer I want all /api/v1/agent/* routes to require validated client certificates in order for me to ensure only enrolled agents can call agent endpoints. Acceptance Criteria: Within 10 calendar days, nginx is configured to require client certs for /api/v1/agent/* except /api/v1/agent/enroll. Within 10 calendar days, backend rejects calls when client cert fingerprint does not match the enrolled server record with HTTP 403. Integration tests verify: no cert fails, valid cert succeeds, mismatched cert fails. 100% of agent endpoints return 401/403 when called without valid agent identity.

boris added the Kind/Security

Priority

Critical

1

labels 2026-02-16 14:29:35 +00:00

boris self-assigned this 2026-02-16 14:29:35 +00:00

boris added this to the Keywarden project 2026-02-16 14:29:35 +00:00

boris added this to the Minumum Marketable Product milestone 2026-02-16 14:32:47 +00:00

boris moved this to Review in Keywarden on 2026-03-28 21:48:39 +00:00

Sign in to join this conversation.