Skip to main content

Takumi Assessments Now Support Targets That Require Client Certificates (mTLS)

· One min read
Tsubasa Umeuchi
Tsubasa Umeuchi
Software Engineer @ GMO Flatt Security Inc.

Takumi blackbox and graybox assessments now support systems that require a TLS client certificate (mTLS).

Overview​

Some systems, such as internal admin consoles and APIs exposed only to business partners, accept only connections that present a client certificate. Takumi could not present one, so it could not assess these systems.

With this release, you can set a client certificate on the assessment dispatch screen. Takumi presents it to the hosts you specify, not only during crawling and scanning but also when verifying the vulnerabilities found by that assessment. It can be configured alongside ID/password sign-in and other authentication, so systems that require multiple forms of authentication can be assessed as well.

The diagram below shows the difference from before.

Connections with and without a client certificate

Getting Started​

You can configure a client certificate from the blackbox and graybox assessment dispatch screens. For the supported certificate formats and settings, see the user guide.

▼ User Guide: Blackbox Assessment / Graybox Assessment