# Webhook Client Certificate

The certificate Aurea presents on the deliveries to an endpoint that asks for mutual TLS: have your server require it.

## Overview

- **Mutual TLS on webhook deliveries is on request** [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md). Until your tenant has it: `404` `WEBHOOK_MTLS_UNAVAILABLE`.
- `certificate`: the X.509 certificate, in PEM. `sha256Fingerprint`: its SHA-256, colon-separated hex. `subject`, `issuer`, `validFrom`, `validTo`. Never a key.
- Configure your server to require a client certificate and trust this one, or its issuer; compare the fingerprint. The route always answers the certificate in use: read it again before `validTo`.
- An endpoint asks for it with `"mtls": true` ([Webhooks & Events](https://docs.aureahub.com/docs/guide-events.md) › Mutual TLS).
- Public: no token and no signature. Cacheable for 5 minutes (`Cache-Control: public, max-age=300`).

## Endpoint

### `GET /v1/webhooks/client-certificate`

Authentication: none (public endpoint).

The client certificate Aurea presents on deliveries to an endpoint with mtls.

**Responses**

`200` OK

```json
{
  "certificate": "-----BEGIN CERTIFICATE-----\nMIIB…\n-----END CERTIFICATE-----\n",
  "sha256Fingerprint": "3A:9F:0C:…:E7",
  "subject": "CN=…",
  "issuer": "CN=…",
  "validFrom": "2026-10-13T00:00:00.000Z",
  "validTo": "2027-10-13T00:00:00.000Z"
}
```

`404` Not offered

```json
{
  "statusCode": 404,
  "error": "NotFoundError",
  "message": "Aurea does not offer mutual TLS on webhook deliveries at the moment",
  "details": { "code": "WEBHOOK_MTLS_UNAVAILABLE" }
}
```

**Example request**

```bash
curl https://api.aureahub.com/v1/webhooks/client-certificate
```

---

Web version: https://docs.aureahub.com/#webhook-client-certificate