# MutualAuthenticationMode

The client certificate handling method.

- Source: [`aws-elasticloadbalancingv2/lib/alb/application-listener.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener.ts#L166)
- Type last changed: v2.154.0 · 22 Aug 2024

## Example

```ts
import * as acm from 'aws-cdk-lib/aws-certificatemanager';

declare const certificate: acm.Certificate;
declare const lb: elbv2.ApplicationLoadBalancer;
declare const bucket: s3.Bucket;

const trustStore = new elbv2.TrustStore(this, 'Store', {
  bucket,
  key: 'rootCA_cert.pem',
});

lb.addListener('Listener', {
  port: 443,
  protocol: elbv2.ApplicationProtocol.HTTPS,
  certificates: [certificate],
  // mTLS settings
  mutualAuthentication: {
    advertiseTrustStoreCaNames: true,
    ignoreClientCertificateExpiry: false,
    mutualAuthenticationMode: elbv2.MutualAuthenticationMode.VERIFY,
    trustStore,
  },
  defaultAction: elbv2.ListenerAction.fixedResponse(200,
    { contentType: 'text/plain', messageBody: 'Success mTLS' }),
});
```

## Members

| Member | Description |
| --- | --- |
| `OFF` | Off. |
| `PASS_THROUGH` | Application Load Balancer sends the whole client certificate chain to the target using HTTP headers. |
| `VERIFY` | Application Load Balancer performs X.509 client certificate authentication for clients when a load balancer negotiates TLS connections. |

## Referenced by

- [`MutualAuthentication`](/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.MutualAuthentication).mutualAuthenticationMode