client-certificate-authmTLS for Node.js

Express middleware, reverse proxy support, and authorization helpers for client certificate authentication

Direct TLS & Reverse Proxy

Works with socket-based mTLS and header-based cert extraction from AWS ALB, Envoy, Cloudflare, Traefik, nginx, HAProxy, and more.

Pre-built validators for CN, fingerprint, issuer, OU, SAN, email, and serial — with allOf/anyOf combinators.

Express middleware out of the box. Use extractClientCertificate() to build adapters for Koa, Fastify, Hapi, or any Node.js framework.

100% test coverage, mutation testing, and E2E tests against real proxy containers. Dual ESM/CJS with full TypeScript types.