Independent reference. Not affiliated with any vendor mentioned. Quote-only vendors render as quote; we do not infer.
DELETEDELETE /hidden-costs/mtls-and-custom-domain

mTLS, custom domain, and WAF add-ons

Three small lines that compound across multiple environments and partner programs.

What's bundled vs paywalled

Cloudflare tier-gates mTLS to Business. Azure includes mTLS on the gateway tier. AWS bundles mTLS in the API Gateway service. The "platform feature" framing often masks a paywall.

Minimising the surface

For partner-facing public APIs, prefer one domain per partner program rather than per partner. Use SAN certs where possible. Audit the WAF rule count.

Primary sources
$ref related routes

Verified 20 June 2026 Oliver Wakefield-Smith, Founder, Digital Signet we mark quote when a vendor does not publish, and stop.