mirror of
https://github.com/juanfont/headscale.git
synced 2026-01-11 20:00:28 +01:00
[Client TLS certificates/ PKI for Headscale enrollment] supported or intentionally unsupported? #1173
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @kim3636 on GitHub (Dec 16, 2025).
Use case
Hi,
In an enterprise environment, it is often required to restrict VPN node enrollment to managed, domain-joined devices only, rather than relying solely on user authentication or possession of a shared secret.
Using an internal PKI (for example Active Directory Certificate Services), machines are issued non-exportable device certificates that provide a strong cryptographic proof of device identity. Mutual TLS (mTLS) is a common mechanism to enforce such machine-level authentication at the network or reverse-proxy layer.
The goal is to ensure that only enterprise-managed devices can enroll with a Headscale control server, even if user credentials or pre-authentication keys are leaked.
Description
Support for Tailscale clients to optionally present a TLS client certificate when connecting to a Headscale control server (or a reverse proxy in front of it), enabling mTLS-based device authentication during enrollment.
This would allow Headscale deployments to integrate with internal PKI infrastructures and enforce device-level trust in addition to existing mechanisms such as OIDC or pre-authentication keys. The feature could be optional and backward-compatible, preserving current enrollment flows where client certificates are not required.
Contribution
How can it be implemented?
No response