# Using Client Certificates for mTLS and Zero Trust Networks > Checkly CTO Tim Nolet explains how you can add a Client Certificate for mTLS in Checkly. Source: https://www.checklyhq.com/blog/using-client-certificates/ --- [Blog](https://www.checklyhq.com/blog/) / [Announcements](https://www.checklyhq.com/blog/tag/announcements/) / [Security](https://www.checklyhq.com/blog/tag/security/) # Using Client Certificates for mTLS and Zero Trust Networks [Tim Nolet](https://www.checklyhq.com/blog/author/tim-nolet/) November 9, 2022 · Updated December 19, 2023 You can now use Checkly to monitor API endpoints secured with TLS Client Certificates. This post dives into why and how you would use client certificates and mTLS (Mutual TLS) in your API infrastructure. Let's go! ## mTLS and Client Certificates primer We'll keep this short as there are many g[reat blog posts](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/)out there explaining mTLS (Mutual TLS) in great detail. But here is the gist: - mTLS is used to authenticate clients, whereas "normal" TLS just authenticates the server. The authentication is now **mutual**! - mTLS works using **public** **key** **cryptography**. This means there is a public key —also commonly referred to as the "certificate" — and a private key. Together we refer to them as the client certificates. - mTLS can be used on any TCP or HTTP connection. It depends on the specific implementation of your web server, router, API gateway or service mesh. Examples here are [Nginx](https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/), [Kong](https://docs.konghq.com/hub/kong-inc/mtls-auth/) and [Linkerd](https://linkerd.io/2.12/features/automatic-mtls/). - mTLS is one of the puzzle pieces of building a [Zero Trust Network](https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/) as it strictly controls which clients are allowed to connect to a service regardless of where a user or device is connecting from (VPN, internal network etc.) and regardless of further user credentials. ## Using Checkly to monitor mTLS endpoints Setting up API monitoring for your mTLS authenticated API endpoints is extremely easy. Just provide the following ingredients: - Domain / hostname. We support wildcards like `*.acme.com` . - Certificate & private key. - Optionally a password and CA certificate. You can configure that [in our web UI](https://app.checklyhq.com/settings/account/client-certificates) or use our [public API](https://developers.checklyhq.com/reference/getv1clientcertificates). Make sure your certificates and private key are in `PEM` format. Note that support for Terraform and Pulumi is coming soon. If you have them in `PKCS12` format, just convert them with the following incantation of the `openssl` command 👇 ``` openssl pkcs12 -in .p12 -out .key -nodes -nocerts openssl pkcs12 -in .p12 -out .cert -nokeys ``` _use openssl to convert a PKCS12 bundle to PEM format_ After adding the certificate, any API checks that target this host, i.e. `https://api.acme.com` will be instrumented with the client certificate. Or, in other words, there is no need to add the client certificate to all relevant API checks. Checkly does the matching for you. And that is it! Client Certificates are now available to all Checkly users on an Enterprise plan. ## Further reading Read more on how to use client certificates [in our docs](https://www.checklyhq.com/docs/api-checks/client-certificates/) and check out our [public API documentation](https://developers.checklyhq.com/reference/getv1clientcertificates) on how to manage client certificates programmatically. [Tim Nolet](https://www.checklyhq.com/blog/author/tim-nolet/) Chief Evangelist In This Article - mTLS and Client Certificates primer - Using Checkly to monitor mTLS endpoints - Further reading Monitor with AI Let your agents create & deploy monitors with deep understanding of your application [Start for free](https://app.checklyhq.com/signup) Share on social Try Checkly ## Catch it before your users do Run Playwright and API checks against production every minute, from locations around the world. Your checks live in your repo and deploy with your code. [Start for free](https://app.checklyhq.com/signup) [Book a demo](https://www.checklyhq.com/demo-request/) Free plan. No credit card. # scaffold a project with example checks $ npm create checkly@latest # run them from our global locations $ npx checkly test # turn them into production monitors $ npx checkly deploy ## Related Articles [Is Your Ecommerce Site Ready for Black Friday and Cyber Monday? November 18, 2022](https://www.checklyhq.com/blog/is-your-ecommerce-site-ready-for-black-friday-and-cyber-monday/)[Running API and Browser Checks Using Terraform, AWS, and Checkly Private Locations February 7, 2023](https://www.checklyhq.com/blog/running-api-and-browser-checks-using-checkly-private-locations-terraform-and-aws/)[Why We Built a Developer-First Typescript CLI for Monitoring as Code February 27, 2023](https://www.checklyhq.com/blog/why-we-built-a-developer-first-typescript-cli-for-monitoring-as-code/)[Manage your incidents with the new ilert integration June 12, 2023](https://www.checklyhq.com/blog/checkly-ilert-announcement/)[Checkly CLI is Now GA, and We've Launched Our New Website and Branding May 9, 2023](https://www.checklyhq.com/blog/checkly-cli-is-now-ga-and-weve-launched-our-new-website/)