From 60438694e4f2a3c2f9ef8d66c8deff51c67174f1 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Thu, 17 Jul 2025 00:08:34 +0400 Subject: [PATCH] Update tls-cert-auth.mdx --- .../platform/identities/tls-cert-auth.mdx | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/documentation/platform/identities/tls-cert-auth.mdx b/docs/documentation/platform/identities/tls-cert-auth.mdx index e11d0c06e..4968ad9c4 100644 --- a/docs/documentation/platform/identities/tls-cert-auth.mdx +++ b/docs/documentation/platform/identities/tls-cert-auth.mdx @@ -42,10 +42,14 @@ To be more specific: Most of the time, the Infisical server will be behind a load balancer or proxy. To propagate the TLS certificate from the load balancer to the instance, you can configure the TLS to send the client certificate as a header - that is set as an [environment - variable](/self-hosting/configuration/envars#param-identity-tls-cert-auth-client-certificate-header-key). + that is set as an [environment variable](/self-hosting/configuration/envars#param-identity-tls-cert-auth-client-certificate-header-key). + + Infisical US/EU and dedicated instances are deployed with AWS ALB. TLS Certificate Auth must flow through our ALB mTLS pass-through in order to authenticate. + When you are authenticating with TLS Certificate Auth, you must use the port `8433` instead of the default `443`. Example: `https://app.infisical.com:8433/api/v1/auth/tls-cert-auth/login` + + ## Guide In the following steps, we explore how to create and use identities for your workloads and applications on TLS Certificate to @@ -123,7 +127,7 @@ try { const clientCertificate = fs.readFileSync("client-cert.pem", "utf8"); const clientKeyCertificate = fs.readFileSync("client-key.pem", "utf8"); - const infisicalUrl = "https://app.infisical.com"; // or your self-hosted Infisical URL + const infisicalUrl = "https://app.infisical.com:8433"; // or your self-hosted Infisical URL const identityId = ""; // Create HTTPS agent with client certificate and key