Type alias GetCertificate

GetCertificate: ((req) => ClientCertificate | undefined)

Type declaration

- (req): ClientCertificate | undefined
- Resolves the client certificate presented on the TLS connection for the current request, used to validate certificate-bound (mTLS, RFC 8705) access tokens.
  
  APIs typically run behind a TLS-terminating proxy (nginx, ALB, Cloudflare, etc.) that forwards the client certificate in a request header (commonly as URL-encoded PEM). Because the header name and encoding vary by deployment, you supply this function to extract the certificate from wherever your proxy places it, returning the PEM text or DER bytes. For a process terminating TLS directly, return req.socket.getPeerCertificate().raw.
  
  Return undefined when no certificate is present; a certificate-bound token received without one is rejected.
  
  Supplying this resolver also opts the request into mTLS validation: it sets mtls.enabled to true by default (see {@Link AuthOptions.getCertificate}). Set mtls: { enabled: false } explicitly to keep mTLS off while still resolving certificates for your own use.
  Parameters
  - req: Request
  Returns ClientCertificate | undefined
  Example
```
// nginx forwarding URL-encoded PEM in a header:
getCertificate: (req) => {
  const pem = req.headers['client-certificate'];
  return typeof pem === 'string' ? decodeURIComponent(pem) : undefined;
}
```