ngscheurich
Anyone here have experience with getting mutual TLS authentication working with an Elixir HTTP client?I have a CA file, certificate, and private key that work in a few other contexts with the request am trying to make:
- In Postman, using the built-in “Certificates” feature
- With curl, using
--capath,--cert, and--key - In Node.js, using the request-promise library
In terms of Elixir, I’ve tried with HTTPoison and Mint, setting the :ssl and :transport_opts options, respectively, to:
[
certfile: @certfile,
keyfile: @keyfile,
cacertfile: @cacertfile
]
Mint times out on connect/4 and HTTPoison sends the request, which the server rejects.The relevant information I can extract from the 400 response that HTTPoison gets me is “400 The SSL certificate error”—not very helpful. I’ve reached out to the support team for the API I am working with, but I was hoping you folks might have some insight in the interim.
Thanks in advance!
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Elixir, Erlang & messaging conferences from Code Sync. Next up: ElixirConf US (10–11 Sep) & Code BEAM Europe (21–22 Oct), Haarlem + online.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
Producing high quality Elixir screencasts since 2017.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 3 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
davemenninger
I’ve gotten it to work with HTTPoison, something like this:
ngscheurich
Thanks for the tip, @tangui—I’ll have a go with verbose
:httpcand report back.The cert I’m testing with is a Let’s Encrypt certificate generated with certbot, so I think I’m okay as far as having a known CA, especially given the fact that the request works using other HTTP tools, e.g. curl.
tangui
Maybe you can give a try with
:httpc, after setting theverboseoption ofset_options/1to one ofverbose,debugortrace. You should get detailed log messages.You can look in APIacAuthMTLS tests how to use it.
Meanwhile, are you using the public X509 infrastructure at both ends, or privately generated certs? In the latter case, are you sure they’ve added your cert (or cert root) to their CA file?