Repository navigation
[FEATURE]: Add first-class mTLS client certificate support for HTTPS/MCP/provider connections #14696
Closed as not planned
Description
- I have verified this feature I'm about to request hasn't been suggested before.
Summary
OpenCode should support first-class mutual TLS (mTLS) for outbound HTTPS connections, including provider API calls and remote MCP servers that require client certificate authentication.
Today, users can set custom CA trust (NODE_EXTRA_CA_CERTS), but there is no clear first-class config path for client cert + key (and optional CA) across relevant network surfaces.
Why this matters
Many enterprise environments require mTLS for:
- outbound API access through secure gateways
- internal MCP endpoints
- zero-trust service-to-service access
Without mTLS support, OpenCode is difficult to use in regulated/corporate environments.
Proposed config
Add explicit config options (names are examples):
{
"network": {
"mtls": {
"cert": "/path/client-cert.pem",
"key": "/path/client-key.pem",
"ca": "/path/ca.pem",
"passphrase": "{env:MTLS_KEY_PASSPHRASE}"
}
}
}And/or allow per-target overrides, e.g. per provider or per MCP server.
Expected behavior
- OpenCode can establish HTTPS connections that require client cert authentication.
- mTLS config is supported in:
- provider requests
- remote MCP HTTP/SSE transport
- other outbound HTTPS flows used by OpenCode
- Failure messages are actionable (missing cert/key, invalid format, handshake failure, etc.).
- Paths and secrets are not logged in plaintext.
Acceptance criteria
- Documented config schema for mTLS cert/key/ca
- Works for at least provider and remote MCP connections
- Works with PEM cert+key files
- Clear troubleshooting docs for TLS handshake failures
- Tests covering success and common failure cases
Reacted by Alex Malkevich, alvtsky, Jean-Pierre Marcotte, anastas001 and Matus Kosut
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Feb 22, 2026
This issue doesn't fully meet our contributing guidelines.
What needs to be fixed:
[FEATURE]:(currently uses "Feature:" without the required bracket format)Please edit this issue to address the above within 2 hours, or it will be automatically closed.
If you believe this was flagged incorrectly, please let a maintainer know.
[-]Feature: Add first-class mTLS client certificate support for HTTPS/MCP/provider connections[/-][+][FEATURE]: Add first-class mTLS client certificate support for HTTPS/MCP/provider connections[/+]cruzanstx commentedon Feb 22, 2026
Updated per template requirements: title now uses and the verification checkbox is included at the top.
cruzanstx commentedon Feb 22, 2026
Correction: title now uses [FEATURE]: prefix and the required verification checkbox is included at the top.
github-actions commentedon Feb 22, 2026
Thanks for updating the issue! It now follows the contributing guidelines and feature request template. We appreciate the clear description of the use case and proposed config. The team will review it.
ak4153 commentedon Mar 6, 2026
#16368
I have implemented this before looking for a relevant issue.
This pr however only works with providers that require mtls
gund commentedon Mar 27, 2026
This would also be useful for
opencode attach [url-with-mtls]command when its behind a reverse proxy with mTLS authentication.Currently such servers are only usable via web interface and not TUI unfortunately.
github-actions commentedon Jul 4, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.