TLS client certificate

The TLS connections established from Gatekeeper to the webhook are signed with a certificate authority that proves the connection was made from a Nuance system. See the Certificate Authority for TLS Connections for the DER-encoded X.509 certificate authority file.

If there are certificates set in clientCerts, then the first one that matches the current client private key is used instead of the built-in certificate signed by the Gatekeeper certificate authority. Since the private key is for the RSA format, it is matched against a certificate using their modulus values.

The private key is changed every year. A few weeks before the new client private key is used, Nuance provides the next key’s Certificate Signing Request. To avoid disruptions, Nuance recommends placing in clientCerts the certificate that matches the current client private key followed by the certificate that matches the next client private key. The current CSRs and their applicable time range are listed in Client Key Certificate Signing Requests.