We have had many many support problems when our corporate customers try to set up Mutual TLS with our SAAS servers. Plus there is no good solution for maintaining 100% uptime while changing/updating the leaf cert.

I suggest that you consider using dual HMAC headers instead. See the write up from Box for a good solution:

• Notification payload section of their API manual
• Look for the Signatures subsection

Proposing an alternate to Mutual TLS...

We have had many many support problems when our corporate customers try to set up Mutual TLS with our SAAS servers. Plus there is no good solution for maintaining 100% uptime while changing/updating the leaf cert.

I suggest that you consider using dual HMAC headers instead.

Also, HMAC provides an end to end check of the contents validity unlike the transport layer check of TLS / Mutual TLS

See the write up from Box for a good solution:

• Notification payload section of their API manual
• Look for the Signatures subsection