This was recently posted on Reddit and might be helpful.

https://www.reddit.com/r/openwrt/comments/1vwq1ey/google_nest_wifi_router_h2d_board_mistral_qcs404/

I use mTLS for Home Assistant and Navidrome.

It’s very secure, the only limiting factor is that the client apps need to support them (or you use a PWA).

Sorry, I think I misread the comment when I made my initial reply.

Edit:

If you mean the key provided for the demonstration, you could ensure that you get the correct one by checking the signature (it’s signed by my personal key) or by doing the initial download through i2p or tor. Once it’s added to your keyring, you maintain that same key for all the subsequent checks. Or, if you don’t want to do either, you could consider it as a Trust-on-first-use system.

The important point is that it’s a layered system, rather than a single point of trust, and that once you trust it, it cannot be compromised.

deleted by creator

I’ll add: mTLS would only break because the client certs are typically signed by a private CA and the host is configured to only trust that specific CA (similar to the enterprise solution I referenced in the post).

If, for some reason, the host was configured to trust all of the typical public CAs, then mTLS would theoretically share the same problem.

Not directly, but I believe mTLS would break if the traffic was intercepted/altered, so it sort of works to test the connection.

mTLS requires installing a certificate on the client device, though. If you’re able to do that, then you’re also able to pin the correct cert or install a custom CA. This would be the “enterprise” solution, as far as I know, but doesn’t work well for public sites, since you can’t always configure your end-users devices.

Edit: mTLS is still very useful, though. I use it to secure some of my services. It just doesn’t solve this specific problem.