---
sourceDocument: Australia Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/integrate-applications

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Reverse Tunnel mTLS authentication

# Reverse Tunnel mTLS authentication {#ariaid-title1}

Release version: Australia  
Updated May 31, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Reverse Tunnel uses mutual TLS (mTLS) to authenticate private relays before any data is exchanged. Both the gateway and the relay verify each other's identity using X.509 certificates issued by the ServiceNow iPKI service.

## Why mTLS is required {#reverse-tunnel-mtls__section_zmv_sgy_pjc}

Only relays that present a valid iPKI-issued certificate can register with the gateway, which helps prevent unauthorized data access.

## Certificate issuance {#reverse-tunnel-mtls__section_anv_sgy_pjc}

When a private relay starts up for the first time, a certificate signing request (CSR) is generated and submitted to the instance. The instance processes the request and returns a signed certificate. The certificate is stored
locally and used to authenticate with the gateway on every subsequent connection.

ServiceNow iPKI issues and renews relay certificates automatically; you don't manage them.

Certificate expiration is checked on startup and daily. If the certificate expires within 30 days, a new CSR is generated, submitted to the instance, and the connection is re-established using the renewed certificate.