chao-zhang

It's feasible while you have to write a bit of code to assemble the certificate details to the API request (e.g., request headers, or query string).

mTLS is both possible for client -> APISIX and APISIX -> upstream.

Apache APISIX also has several security features to help reinforce API security. For instance:

1. It can dynamically manage lots of TLS certificates and do the TLS/SSL terminate or use mTLS to communicate with the upstream; 2. Plugins like ACL, IP Restriction, CSRF, and Referrer Restriction restrict API access in different dimensions.