--- title: "mTLS Authentication for NFS" slug: "mtls-authentication-for-nfs" tags: ["5.5"] updated: 2026-10-27T23:00:54Z published: 2026-10-27T23:00:54Z canonical: "docs.vastdata.com/mtls-authentication-for-nfs" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # mTLS Authentication for NFS The VAST cluster supports mTLS authentication of NFSv3 and NFSv4 connections, where in addition to the client authenticating the server before establishing a secure connection, the server must also authenticate the client using a certificate. In multi-tenant environments, you can configure the VAST NFS server to distinguish between mTLS certificates associated with particulars tenants, and thus to direct the IO to the intended tenant based on the client certificate (in addition to using the client IP or destination virtual IP for that purpose). This improves security while enforcing tenant isolation and tenant-level authorization for NFS clients. mTLS authentication for NFS can be configured on the VAST cluster as follows: - By creating a [cluster-wide configuration](/docs-5-5/docs/mtls-authentication-for-nfs#creating-a-clusterwide-configuration-for-mtls-authentication-of-nfs) that includes: - Cluster CA certificate for mTLS authentication - Indication which OID within the `otherName` entry of the client certificate’s SAN extension to use for tenant identification - Labeling of tenants with ID strings that will be used for tenant identification - [At the tenant level](/docs-5-5/docs/mtls-authentication-for-nfs#adding-an-mtls-certificate-for-a-tenant), by adding a tenant-specific mTLS CA certificate. You can choose whether you want to [enforce](/docs-5-5/docs/mtls-authentication-for-nfs#enforcing-mtls-authentication-for-nfs-per-view) mTLS authentication for NFS per view by setting a flag in the view policy. ## Prerequisites - mTLS authentication for NFS requires TLS 1.3. - The VASTNFS driver is required to use mTLS certificate-based tenant identification for NFSv3. (NFSv4 does not require VASTNFS.) - [TLS encryption for NFS](/docs-5-5/docs/configuring-tls-encryption-with-nfs) must be configured on the VAST cluster. - For clients using multiple certificates for different NFS exports (certificate per mount), Linux kernel 6.17 or later is required. ## Limitations - Revocation of an mTLS certificate by using CRL Distribution Points (CDP) is not supported. - A CRL file can contain up to 100 certificates to be revoked. - When using NFSv3, if a parent view does not have TLS or mTLS enforced, the VAST cluster allows unencrypted access to any of its child views, regardless of whether the child view has TLS or mTLS enforcement configured on it. ## Client-Side Configurations - The client must have the client certificate and private key installed (in addition to the CA certificate used to validate the VAST NFS server during regular TLS handshake). The client's `/etc/tlshd.conf` must have the following lines included: ```plaintext [authenticate.client] x509.truststore = x509.certificate = x509.private_key = ``` - The `tlshd` service must be up and running. - The `xprtsec=mtls` NFS mount option must be specified for the mount. - When using mTLS certificate-based tenant identification for NFSv3, the client must mount with `mountproto=tcp`. ## Creating a Cluster-Wide Configuration for mTLS Authentication of NFS Cluster-wide configuration of mTLS authentication for NFS enables certificate-based tenant identification. The cluster-level CA certificate for mTLS authentication is used for all tenants. > [!WARNING] > Warning > > The cluster-wide configuration overrides any tenant-level settings. Applying the customer-wide configuration may cause temporary disconnection of tenant clients. Complete these steps: - In VAST Web UI: 1. Go to Settings -> Certificates , select the NFS/Kafka mTLS Auth certificate type in the Certificate for field, and click Add certificate under NFS Certificates (or under NFS and Kafka Certificates). - Add the CA certificate and, optionally, the CRL file in the fields provided. - In the Tenant association (SAN) field, specify an Object Identifier (OID) of an `otherName` field within certificate's Subject Alternative Name (SAN) extension that will be used for tenant identification. The cluster will compare the value within this field to the tenant's mTLS identifier (entered in the step below). For example: `1.3.6.1.2.1.25.2.1.2.3.4.5.6.100`. This value must be unique across the SAN `otherName` fields. 2. For each tenant you need, open tenant settings (Element Store -> Tenants -> right-click a tenant and select Edit) and go to the Advanced Protocol Settings tab. - In the mTLS identifier field, enter an ID string that will be used to identify the tenant during mTLS authentication for NFS. The tenant's mTLS identifier must be unique across the cluster. - In VAST CLI: - Run the `tlscertificate create` command with the `--protocol NFS` and `--tenant-associate-param` options specified. Do not include `--tenant-id` on the command. - Run the `tenant modify` command with the `--mtls-identifier` option specified. ## Adding an mTLS Certificate for a Tenant A tenant-level mTLS CA certificate must be unique across all tenants. If the tenant is configured with a CA certificate and the client sends a certificate that is not signed by this CA (or a trust chain that does not provide for the signing), access is denied. To add an mTLS certificate for a tenant: - In VAST Web UI: 1. Open the Authentication settings for mTLS pane in tenant settings (Element Store -> Tenants -> choose to create or edit a tenant -> Advanced Protocol Settings tab). 2. Click Add Certificate under NFS Certificates or Kafka and NFS Certificates. 3. Enter a certificate with a CRL file (optional) in the fields provided. Up to 2 certificates can be added per tenant. - In VAST CLI: - Run the `tlscertificate create` command with the `--protocol NFS` and `--tenant-id` options specified. For example: ```plaintext tlscertificate create --protocols NFS --ca-certificate-file /cert/full-CA.pem --tenant-id 1 ``` ## Enforcing mTLS Authentication for NFS per View You can configure a view policy to enforce mTLS authentication for NFS clients. If the enforcement flag is set, the cluster denies access for clients that do not present a valid client certificate. This also applies to clients accessing the cluster from allowed client virtual IPs configured for the tenant or from the tenant's dedicated virtual IP pool. View policies that span multiple tenants cannot have the enforcement flag set. To set the mTLS authentication enforcement flag in a view policy: - In VAST Web UI, use the Enforce mTLS encryption option in view policy settings (Element Store -> View Policies -> choose to create or edit a view policy -> NFS tab). - In VAST CLI, run the `create viewpolicy` or `modify viewpolicy` command with the `--nfs-enforce-mtls` option specified. > [!NOTE] > Note > > When using NFSv3, if a parent view does not have TLS or mTLS enforced, the VAST cluster allows unencrypted access to any of its child views, regardless of whether the child view has TLS or mTLS enforcement configured on it.