Reference

Headless mTLS

Headless mode exposes Jeden to authenticated clients without weakening local capability and approval policy.

Usage

Terminal

$ jeden headless <addr> \
  <server-cert.pem> <server-key.pem> \
  <client-ca.pem> <identity-map.json> \
  [revoked-serials.txt]

Identity

The server certificate authenticates the service. The client CA authenticates client certificates. The identity map converts a certificate identity into an explicit Jeden principal; unknown identities are rejected.

Revocation

The optional serial list denies known client certificates even when their chain remains valid. Keep it readable by the service and update it atomically.

Local policy remains authoritative

Mutual TLS authenticates transport and caller. It does not grant write, command, browser, SSH, plugin, or MCP authority by itself. Those decisions remain local and auditable.