Auth0 mTLS Handshake Failure Occurs With Auth0-Managed Certificates

An mTLS handshake failure occurs when attempting to establish a connection using a Custom Domain with Auth0-managed certificates. The connection fails during token endpoint authentication and logs the following error:

(feccft) Failed Exchange: Failed client authentication with "missing or empty client-certificate-ca-verified header"

• Auth0
• mTLS
• Custom Domains
• Token Endpoint Authentication

Auth0 does not support mTLS with Auth0-managed certificates. Currently, it only supports mTLS with Custom Domains using self-managed certificates.

Configure the custom domain to use self-managed certificates and patch the custom domain to support mTLS.

1. Follow the guidelines in the Self-Managed Certificates Guide to configure a self-managed certificate.
2. Patch the existing custom domain to support mTLS by following the instructions in the Configure mTLS for a Tenant Documentation.