Client Certificates

Yaak supports TLS client certificates for mutual authentication (mTLS). Configure certificates in Settings and Yaak applies them automatically to matching requests.

Adding a Certificate

Open Settings and navigate to the Certificates tab.

PFX/PKCS#12

For bundled certificate and key files:

1. Click Add Certificate
2. Select your .pfx or .p12 file
3. Enter the passphrase if encrypted
4. Enter the host to match
5. Optionally specify a port

Certificate + Key

For separate PEM files:

1. Click Add Certificate
2. Select your certificate file (.crt, .pem, .cer)
3. Select your private key file (.key, .pem)
4. Enter the passphrase if the key is encrypted
5. Enter the host to match
6. Optionally specify a port

Host Matching

Certificates match requests by hostname (case-insensitive). If you specify a port, it must also match. Without a port, the certificate matches any port on that host.

api.example.com        # Matches any port
api.example.com:8443   # Matches only port 8443

Multiple Certificates

Add multiple certificates for different services. Yaak uses the first matching certificate for each request.

Toggle certificates on/off without deleting them using the enable checkbox.

Supported Formats

Format	Extensions
PFX/PKCS#12	.pfx, .p12
PEM Certificate	.crt, .pem, .cer
PEM Key	.key, .pem
DER Certificate	.der, .cer