By default, HTTPS uses one-way authentication: the client verifies the server's identity. Alibaba Cloud CDN supports client certificate authentication, which lets the server verify the client using a custom Certificate Authority (CA) certificate. This enables mutual authentication and strengthens communication security.
Prerequisites
Before you begin, ensure that you have:
Configured an HTTPS certificate for the domain name
A custom Client CA Certificate, including the public key
How it works
When you enable client certificate authentication, CDN acts as the server during the TLS handshake. Every incoming HTTPS request must include a client certificate. CDN validates the certificate against the CA certificate you provide:
Valid certificate: CDN allows the request through.
Invalid certificate: CDN rejects the request.
Enable client certificate authentication
Log on to the CDN console.
In the left navigation pane, click Domain Names.
On the Domain Names page, find the domain name you want to manage and click Manage in the Actions column.
In the left navigation pane for the domain name, click HTTPS.
Enable Client Certificate Authentication, then paste your Client CA Certificate in the field that appears.
The certificate must meet the following requirements:
Requirement Detail Format Content must be enclosed between -----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----Line length Each line must contain exactly 64 characters, except the last line, which may be shorter 
Click OK.