Amazon CloudFront Enables Passthrough Mode for Mutual TLS Authentication at the Origin

CloudFront introduced passthrough mode to forward client certificates directly to origin servers, facilitating seamless integration with existing mTLS validation setups.

By Daniel Brooks · Editorial pseudonym · 2026-05-14 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-05-14. Source published: 2026-05-14. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

With passthrough mode, CloudFront does not validate client certificates at the edge but transmits full certificate chains to configured origins, allowing customers to maintain their own authentication logic. This enables organizations to add CloudFront's global delivery network without modifying existing mTLS workflows.

The mode supports connection functions for customized processing before origin forwarding and coexists with existing required and optional mTLS modes in CloudFront. This addition provides flexible deployment options for customers with diverse security architectures at no extra cost.

Source & further reading

Amazon CloudFront announces Passthrough Mode for mutual TLS (Viewer) ↗

Source published 2026-05-14. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.