Enum McpClientCertificateRequirement

Namespace

MailFathom.Infrastructure.Security.ClientCertificates

Assembly

MailFathom.Infrastructure.dll

Whether the client a trust profile identifies has to present its certificate.

public enum McpClientCertificateRequirement

Fields

Optional = 0

A request without a client certificate is served; a certificate that is presented is still validated against every profile.

Required = 1

A request without a client certificate is refused, whichever other credential it carries.

Remarks

The distinction is about the request that arrives without a certificate at all, because that is the only one no profile can be matched against. A deployment carrying at least one Required profile refuses such a request; one whose profiles are all Optional serves it and simply identifies no client application.

Optional is therefore what a profile beside another authentication mechanism states: the ChatGPT connector presents its managed certificate while a workstation reaches the same endpoint with an API key alone. Required is what a deployment states once every client it serves holds a certificate.