a6-recipe-mtls

Configure mutual TLS end-to-end for APISIX using the a6 CLI.

1|2|Updated Mar 6, 2026
One-click install
npx skills add https://github.com/api7/a6 --skill a6-recipe-mtls-api7
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: a6-recipe-mtls
Source: https://github.com/api7/a6/tree/main/skills/a6-recipe-mtls
Command: npx skills add https://github.com/api7/a6 --skill a6-recipe-mtls-api7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Mutual TLS (mTLS) configuration for APISIX via the a6 CLI, enabling strong client and upstream authentication to secure service-to-service communication.

Core Features & Use Cases

  • Client→APISIX mTLS: require clients to present valid TLS certificates when connecting to APISIX.
  • APISIX→Upstream mTLS: APISIX uses client certificates when calling upstream backends over TLS.
  • End-to-End mTLS: combine both directions for complete mutual authentication across the full path.

Quick Start

Run the sample workflow to enable mTLS by creating an SSL resource, a secure upstream, and a route that uses TLS.

Frequently Asked Questions about a6-recipe-mtls

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure mutual TLS for APISIX using the a6 CLI?

You can configure mutual TLS for APISIX using the a6 CLI by creating an SSL resource, defining a secure upstream, and synchronizing a route that enforces TLS. This secures both client and upstream communication end-to-end.

What is end-to-end mTLS and how does it secure microservices?

End-to-end mTLS secures microservices by requiring TLS certificates for both the client connecting to APISIX and APISIX connecting to the upstream backend. This mutual authentication ensures secure service-to-service communication across the full path.

How do I require client certificates for APISIX routes via a6?

To require client certificates for APISIX routes via a6, you configure client-to-APISIX mTLS. This enforces strong client authentication by demanding valid TLS certificates when clients connect to APISIX.

Can I use the a6 CLI to apply TLS certificates to upstream communications?

Yes, you can use the a6 CLI to apply TLS certificates to upstream communications. By configuring APISIX-to-upstream mTLS, APISIX presents a client certificate when calling upstream backends over TLS.

Do I need to manually create SSL resources before setting up APISIX mTLS?

Yes, setting up APISIX mTLS requires creating an SSL resource first. You use the a6 ssl command to manage certificates before defining the secure upstream and route that utilize the TLS configuration.