Tried it and it was a breeze to set it up with Caddy!
Problem was… lack of client side support, specially on mobile.
Many (most?) client apps don’t support it.
Use the PWA from your browser, you said? I hope you like Google and using Chrome, because Firefox for Android doesn’t support it 😭
I was curious so I looked it up… But it should technically work on FF for Android, although there is a bug in the UI.
See:
I haven’t watched the video yet, but it’s generally not worth the hassle of setting up mutual TLS if you’re already using a peer-to-peer VPN like Tailscale, as the VPN software is already doing mutual authentication.
Edit: A peer-to-peer VPN (or mesh VPN) is one where two systems that are connected to the VPN can directly communicate with each other, instead of needing to go through a central server as with something like OpenVPN. With Tailscale or Wireguard, the peers need each other’s public keys to communicate.
This is only true for the connection security. With mTLS you can also authenticate to the webapplication you’re trying to reach. So consider your use-case between von/mtls.
mTLS is so cool, until you find out that almost no clients support it.
Immich supports it.
I tried long ago, but as they said, client side authentication is an issue, most clients do not support it.
I have a system, I use wireguard vpn and for when I want to use a domain name with proper tls (because some client apps require a proper tls connection to work) I set my caddy reverse proxy to only accept request from
localhostlocal network.So, there’s a public domain with let’s encrypt TLS, and that domain can only be properly access from local network. Then I connect using vpn to my local network and the client app can access the service over a CA verified TLS.
