Hello,
We’re running a single Tyk Gateway instance hosting multiple APIs:
- Most of our APIs are secured using mTLS.
- Some APIs are intentionally exposed as keyless/public.
Our goal is to allow users to access the keyless APIs directly from a web browser without being prompted to select a client certificate.
As I understand it, the browser certificate selection prompt occurs during the TLS handshake, before Tyk is able to determine which API is being requested, so the behavior is expected when mTLS is enabled on the listener.
We currently have all APIs behind the same Gateway instance and would prefer not to deploy a second Gateway instance just to separate mTLS and non-mTLS traffic.
Is there a recommended Tyk architecture or configuration that allows:
- mTLS enforcement for selected APIs,
- keyless/public access for other APIs,
- and no client certificate prompt when accessing the public APIs,
while using a single Gateway instance?
Any advice or best practices would be appreciated.
Thanks!