jkbbwr
I am able to do MTLS connections to a given service using curl and httpie. That works fine.
An example of a working httpie command http post --cert=./cert.pem --cert-key=./cert.key <url>
The key is passphrase protected, but I have tried using an unprotected one in Req/elixir and no dice.
But as soon as I try to replicate that in elixir using Req I get errors from the service saying that there is no client certificate being used.
I have tried using certfile and keyfile and password but nothing seems to work and there is remarkably no documentation about this.
I could swear I had it working before but I cannot for the life of me get it working now.
I appreciate this will be reasonably tricky to identify as I cannot obviously share the keys. But I would love any help, I am going slowly insane.
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Producing high quality Elixir screencasts since 2017.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #hex
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 4- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
jjcarstens
What you’re probably missing is CAs for the sever you’re connecting to. curl has a bit of magic to look in your system for CA store files with all the typical globally trusted root CAs. However, you have to explicitly give that to erlang. Adding
cacerts: :public_key.cacerts_get()option would probably fix it for you so the server chain can be validated.When in doubt, you can also set
log_level: :debugin the SSL options to get more hints about where it is failingjkbbwr
Problem is, its not failing the SSL its just not sending the client certificates (or so it seems)
Where do I set the debug level? Currently I am trying to use Req but I have tried several.
adw632
Req uses Finch as its default adapter and Finch uses Mint (which allows all of the Erlang
:gen_tcpand:sslsocket options to be passed).So looking at the Req run_finch/1 documentation we see
:connect_optionswhich contains:transport_optswhich defers to Mint for the details.The mutual TLS options for Mint was answered here as not all options are covered in the Mint documentation, only the ones they alter the semantics of.
So your code will be something like:
Note that Erlang needs charlists passed.
jkbbwr
Great answer, I think there was something to do with a TLS1.3 → 1.2 bug in erlang itself. That might be partly to blame for this. I have to deprio this right now but Ill keep it in mind.