<p>I have a scenario where an external app (not on Istio) is calling our services to get some data. Client sends in it's certificate in the WebRequestHandler that we validate as a way to authenticate the client. Can this be done at the ingress-gateway level?</p>
<p>Please note that I am also terminating the TLS traffic at the gateway and forwarding the request to the corresponding services on different pods based on http url-regex matching. I am also okay to validate the certificate in my service's code given it reaches the service as it is (excuse me for sounding naive here, I am very new to this).</p>
<p>Thank you!</p>

Jim
<p>If you want mutual TLS between an external service and Istio's Ingress Gateway then that's possible and is documented here: <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/</a></p>
