Enable mTLS per resource?

[e-minguez]

After the latest release it seems per resource mTLS can be enabled https://middleware-manager.hhf.technology/docs/ui-guides/security-mtls#per-resource-mtls however I don't see any toggle on the resource, only the global one.
Can the documentation perhaps be improved? like adding some screenshots or something similar.
Thanks.

[hhftechnology]

@e-minguez

It will only appear if you setup everything correctly in the setup page.

[v1rusnl]

I cannot get it to work with my existing pangolin setup @hhftechnology . CA is created + a client cert imported to Windows and Android. But all I get is the popup to choose the used certificate followed by an error 403 and a blank page when activating mTLS for a ressource. Do I need to do further configuration? Only thing I recognized that ./config/traefik/certs/clients is empty.

pangolin-stuff...

  traefik:
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    container_name: traefik
    depends_on:
      pangolin:
        condition: service_healthy
      crowdsec:
        condition: service_healthy
    image: traefik:v3.6
    network_mode: service:gerbil
    restart: unless-stopped
    volumes:
      - ./config/traefik:/etc/traefik:ro
      - ./config/traefik/logs:/var/log/traefik
      - ./config/traefik/fullchain.pem:/etc/traefik/fullchain.pem:ro
      - ./config/traefik/privkey.pem:/etc/traefik/privkey.pem:ro
      - ./config/traefik/certs:/etc/traefik/certs:ro
      - ./config/traefik/certs/ca/ca.crt:/etc/traefik/certs/ca/ca.crt:ro
  middleware-manager:
    container_name: middleware-manager
    image: hhftechnology/middleware-manager:latest
    volumes:
      - ./data:/data
      - ./config/middleware-manager:/app/config
      - ./config/traefik:/etc/traefik         # Must match Traefik's static config dir
    environment:
      - ACTIVE_DATA_SOURCE=pangolin
      - PANGOLIN_API_URL=http://pangolin:3001/api/v1
      - TRAEFIK_STATIC_CONFIG_PATH=/etc/traefik/traefik_config.yml # Path inside container
      - TRAEFIK_CONF_DIR=/conf
      - DB_PATH=/data/middleware.db
      - PORT=3456
    ports:
      - 127.0.0.1:3456:3456

experimental:
    plugins:
        badger:
            moduleName: github.com/fosrl/badger
            version: v1.3.1
        crowdsec:
            moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
            version: v1.4.6
        mtlswhitelist:
            moduleName: github.com/smerschjohann/mtlswhitelist
            version: v0.4.2
...
providers:
    file:
        filename: /etc/traefik/dynamic_config.yml
    http:
        endpoint: http://middleware-manager:3456/api/v1/traefik-config
        pollInterval: 5s

[middleware-manager] 2026-02-21T22:35:23.983821615Z 2026/02/21 22:35:23 Fetching resources from Pangolin API...
[middleware-manager] 2026-02-21T22:35:23.990848604Z 2026/02/21 22:35:23 Fetched 27 services from Pangolin API
[middleware-manager] 2026-02-21T22:35:24.001190602Z 2026/02/21 22:35:23 Fetched 27 resources, 27 services, 2 middlewares from Pangolin API
[middleware-manager] 2026-02-21T22:35:27.183555311Z 2026/02/21 22:35:27 Updating mTLS config for resource a5f0a673-ee27-4f6f-9d13-0646cd9c3888: enabled=true
[middleware-manager] 2026-02-21T22:35:27.183624309Z 2026/02/21 22:35:27 Update affected 1 rows
[middleware-manager] 2026-02-21T22:35:27.184109350Z 2026/02/21 22:35:27 Successfully updated mTLS configuration for resource a5f0a673-ee27-4f6f-9d13-0646cd9c3888

[pierinh00d]

Hi. Have you solved this issue?
I have the same problem.
I deployed Middleware Manager with Pangolin, following the “Quickstart Guide” section, Option A: Deploy with Pangolin

I installed Pangolin using the installer. The versions are:

Pangolin version 1.18.2
Gerbil version 1.3.1
Traefik version 3.6
Middleware-Manager latest version

I successfully installed the mtlswhitelist plugin, created the CA and the user certificate, and enabled the plugin both in the general configuration and on the resource I wanted to protect

However, it’s not working. When I access the resource, the browser doesn’t ask for the certificate and returns a 403 error.

But if I work with wget passing the certificates,it works like a charm.
What am I doing wrong?

[hhftechnology]

@pierinh00d browser will not ask for cert 403 means its working. you will have to pre install it. ping me on cord i will do a step by step.

[pierinh00d]

Thanks @hhftechnology I wrote a post on discord but I've installed p12 already. Discussion is available at https://discord.com/channels/994247717368909884/1498955328828735558/1501479166477074482

[v1rusnl]

Hi. Have you solved this issue? I have the same problem. I deployed Middleware Manager with Pangolin, following the “Quickstart Guide” section, Option A: Deploy with Pangolin

I installed Pangolin using the installer. The versions are:

Pangolin version 1.18.2 Gerbil version 1.3.1 Traefik version 3.6 Middleware-Manager latest version

I successfully installed the mtlswhitelist plugin, created the CA and the user certificate, and enabled the plugin both in the general configuration and on the resource I wanted to protect

However, it’s not working. When I access the resource, the browser doesn’t ask for the certificate and returns a 403 error.

But if I work with wget passing the certificates,it works like a charm. What am I doing wrong?

No. Still not working until now.