mTLS Client Authentication¶

Some restricted areas of the InteSys panel are protected by mTLS (Mutual TLS), requiring you to present a valid client certificate in addition to your normal login. This is a mandatory security enhancement: without the certificate installed, access to these areas is blocked before the login screen is even shown.

This guide explains what mTLS is, how it is implemented with Cloudflare, and how to install and use your client certificate on the most common operating systems and browsers.

Where to request your certificate

The first issuance of your mTLS client certificate is requested through the Support area of the panel (dash.intesys.io). Open a support ticket asking for your mTLS certificate; our team generates it and delivers it securely as a .p12 file, along with the import password.

What is mTLS?¶

Mutual TLS (mTLS) is an extension of TLS/HTTPS in which both sides authenticate each other:

The server proves its identity to the client with a server certificate.
The client proves its identity to the server with a client certificate.

In traditional HTTPS, only the server is verified:

Browser ──────────────► Server
   1. Server presents its certificate
   2. Browser validates the server
   3. Connection established

With mTLS, the client is verified too:

Browser ◄─────────────► Server
   1. Server presents its certificate
   2. Browser validates the server
   3. Server requests the client certificate
   4. Browser presents the client certificate
   5. Server validates the client certificate
   6. Connection established

The connection is only allowed if both certificates are valid.

Why does InteSys use mTLS?¶

mTLS adds a strong, device-bound authentication factor that complements traditional credentials. Sensitive administrative operations now require something an attacker cannot obtain from a leaked password or phishing alone.

Authentication model	Required factors
Basic	Username + Password
Modern	Username + Password + MFA
InteSys restricted areas	Username + Password + MFA + Client Certificate

To reach an mTLS-protected area, an attacker would need valid credentials, MFA access, and a valid client certificate installed on the device — all at once — which is significantly harder to defeat.

Which areas require mTLS¶

Not the entire panel requires a certificate. Only high-impact operations are protected.

Public area (standard login)Restricted area (mTLS required)

Accessible with username + password + MFA:

Dashboard and service overview
Billing and invoices
Profile and preferences
Opening support tickets

Requires a client certificate in addition to the standard login:

VM console access
Infrastructure management
Sensitive administrative actions
Audit logs
API key management
Destructive or irreversible operations

Areas that require mTLS are flagged within the panel itself.

How it works with Cloudflare¶

Cloudflare acts as the TLS termination point and validates the client certificate before forwarding any request to the origin server.

Browser ──► Cloudflare ──► Origin Server ──► Application
                 │
                 └─ validates the client certificate

During validation, Cloudflare checks:

Certificate chain — issued by a trusted organization Certificate Authority (CA).
Validity — within the Not Before / Not After window.
Revocation status — the certificate has not been revoked (where configured).

Only after successful validation does the request reach the application, where the normal login and authorization checks still apply.

Certificate lifecycle¶

Issuance (onboarding)¶

Organization created
   └─ Organization CA created
        └─ User created
             └─ Client certificate generated
                  └─ PKCS#12 (.p12) file generated
                       └─ Certificate delivered to user
                            └─ User imports the certificate

The first issuance is always requested through the panel's Support area (see the note at the top of this page).

Renewal¶

Certificates are short-lived (for example, 30 days). Before expiry, InteSys generates a new certificate, revokes the previous one, and notifies you to re-import the updated file.

Revocation¶

A certificate must be revoked immediately when:

The user leaves the organization
The user account is disabled
The certificate is lost or exposed
A security incident occurs

Lost your certificate?

If the device holding the certificate is lost, stolen, or compromised, open a support ticket immediately to revoke the current certificate and issue a replacement.

File formats¶

Format	Contents	Typical use
PEM (`.crt` + `.key`)	Certificate and private key in separate files	Linux servers, automation
PFX / P12 (`.p12`)	Certificate + private key + chain in a single password-protected file	Recommended for end users

InteSys delivers your client certificate as a .p12 file — portable and simple to import on any operating system.

Installing your certificate¶

Pick your operating system. In every case you will need the .p12 file and the import password provided by support.

WindowsmacOSLinux

On Windows, Chrome and Edge use the Windows Certificate Store. Firefox can use either the system store or its own.

Chrome / Edge (Windows store)

Double-click the .p12 file.
In the Certificate Import Wizard, select Current User and click Next.
Confirm the file and click Next.
Enter the certificate password.
Keep Include all extended properties checked and finish the wizard.

To verify: Control Panel → Internet Options → Content → Certificates → Personal — the certificate should appear.

Firefox

Recommended: under Settings → Privacy & Security → Certificates, enable Query OS client certificate store (when available).
Alternative: View Certificates → Your Certificates → Import and select the .p12 file.

On macOS, Chrome, Edge, and Safari use the Keychain.

Chrome / Safari / Edge (Keychain)

Open Keychain Access.
Drag the .p12 file into the login keychain.
Enter the certificate password and confirm the import.

To verify: under Keychain Access → My Certificates, the certificate should be visible.

Firefox

Firefox uses its own internal store. Import manually under Settings → Privacy & Security → Certificates → View Certificates → Your Certificates → Import and select the .p12.

On Linux, Chrome uses the NSS database; Firefox uses its own store.

Chrome (via UI)

Go to Settings → Privacy and security → Security → Manage certificates and import the .p12 file.

Chrome (via NSS, alternative)

# Install the NSS tools
sudo apt install libnss3-tools

# Import the certificate into the user's NSS database
pk12util -i user-certificate.p12 -d sql:$HOME/.pki/nssdb

Firefox

Under Settings → Privacy & Security → Certificates → View Certificates → Your Certificates → Import, select the .p12 file and enter the password.

Browser authentication flow¶

When you access an mTLS-protected endpoint:

Cloudflare sends a CertificateRequest to the browser.
The browser shows "Select a certificate".
You pick the correct certificate.
The browser sends the certificate for validation.
If valid, the request is allowed and you reach the application's login screen.
If invalid or missing, access is denied with 403 Forbidden or a TLS handshake failure.

Always select the same certificate

Choose the option to remember your selection (when the browser offers it) to avoid the prompt on every access within the same session.

Troubleshooting¶

Symptom	Likely cause	Solution
Certificate not offered for selection	Not imported, or imported into the wrong store	Re-import the `.p12` into the correct browser/OS store
Browser shows no prompt	Certificate missing its private key, or wrong store	Verify the installation and re-import the full `.p12`
`403 Forbidden` after selecting	Expired or revoked certificate	Request a new certificate through support
TLS handshake failure	Certificate not issued by the trusted CA	Confirm you are using the certificate provided by InteSys

Security recommendations¶

Short-lived certificates — prefer a 7-, 30-, or 90-day validity. Avoid multi-year certificates.
One certificate per user — never share certificates between people or devices.
Revocation capability — the certificate can be revoked immediately if lost or compromised; report any suspicion to support.
mTLS does not replace login — the certificate is an additional factor. You still need username, password, and MFA to reach restricted areas.

Summary¶

mTLS adds an identity-verification layer by requiring a trusted client certificate before access to restricted areas of the InteSys panel.

dash.intesys.io
   ├─ Public area     → Username + Password + MFA
   └─ Restricted area → Username + Password + MFA + Client Certificate (mTLS)

This model delivers strong security for sensitive administrative operations while keeping the everyday experience simple. To get started, request your certificate through the Support area and follow the installation steps above.