Amazon CloudFront announces Passthrough Mode for mutual TLS (Viewer)

This article announces passthrough mode for Amazon CloudFront viewer mutual TLS (mTLS) authentication, enabling certificate forwarding to origins without CloudFront validation.

• CloudFront forwards client certificates to origin for validation without edge verification
• Maintains existing mTLS validation infrastructure at origin without trust store configuration
• Forwards full certificate chain with every request to ensure end-to-end authentication
• Disables caching to guarantee each request is authenticated by origin
• Connection functions still available to inspect or transform certificate data
• Available at no additional cost

Passthrough mode allows customers with existing mTLS implementations to use CloudFront without redesigning their validation logic.