#### [Abblix\.Oidc\.Server\.Mvc](https://www.abblix.com/en/docs/api/abblix-oidc-server-mvc 'index')
### [Abblix\.Oidc\.Server\.Mvc\.Extensions](https://www.abblix.com/en/docs/api/abblix-oidc-server-mvc/Abblix.Oidc.Server.Mvc.Extensions 'Abblix\.Oidc\.Server\.Mvc\.Extensions')

## CertificateForwardingExtensions Class

Extension methods for configuring client certificate forwarding for mTLS support\.

```csharp
public static class CertificateForwardingExtensions
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CertificateForwardingExtensions
### Methods

## CertificateForwardingExtensions\.AddMtlsCertificateForwarding\(this IServiceCollection, string, Action\<CertificateForwardingOptions\>\) Method {#Abblix.Oidc.Server.Mvc.Extensions.CertificateForwardingExtensions.AddMtlsCertificateForwarding(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string,System.Action_Microsoft.AspNetCore.HttpOverrides.CertificateForwardingOptions_)}

Adds certificate forwarding middleware for mTLS when behind a reverse proxy\.
WARNING: Only use when behind a TRUSTED reverse proxy that validates client certificates\.
Improper configuration can allow certificate spoofing attacks\.

```csharp
public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddMtlsCertificateForwarding(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, string headerName="X-Client-Cert", System.Action<Microsoft.AspNetCore.HttpOverrides.CertificateForwardingOptions>? configure=null);
```
#### Parameters

###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Mvc.Extensions.CertificateForwardingExtensions.AddMtlsCertificateForwarding(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string,System.Action_Microsoft.AspNetCore.HttpOverrides.CertificateForwardingOptions_).services}

The service collection\.

###### `headerName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Mvc.Extensions.CertificateForwardingExtensions.AddMtlsCertificateForwarding(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string,System.Action_Microsoft.AspNetCore.HttpOverrides.CertificateForwardingOptions_).headerName}

The header name containing the client certificate\.
Common values: "X\-Client\-Cert" \(nginx\), "X\-Forwarded\-Client\-Cert" \(Envoy\), "X\-SSL\-Client\-Cert"

###### `configure` [System\.Action&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[Microsoft\.AspNetCore\.HttpOverrides\.CertificateForwardingOptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.httpoverrides.certificateforwardingoptions 'Microsoft\.AspNetCore\.HttpOverrides\.CertificateForwardingOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Oidc.Server.Mvc.Extensions.CertificateForwardingExtensions.AddMtlsCertificateForwarding(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string,System.Action_Microsoft.AspNetCore.HttpOverrides.CertificateForwardingOptions_).configure}

Optional callback to customize certificate parsing logic\.

#### Returns
[Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')  
The service collection for chaining\.

### Remarks
This method configures ASP\.NET Core's built\-in certificate forwarding with sensible defaults
for common reverse proxy setups\. The certificate can be in PEM or Base64\-encoded DER format\.

After calling this method, add app\.UseCertificateForwarding\(\) to your middleware pipeline
BEFORE app\.UseAuthentication\(\)\.

Example:

```csharp
services.AddMtlsCertificateForwarding("X-Client-Cert");

// In middleware pipeline:
app.UseCertificateForwarding(); // Before authentication
app.UseAuthentication();
```