Hello,
We are trying to submit our plugin (previously called “app”) through the portal, however the mTLS that we configured in our domain, using OpenAI’s root and intermediate certificates, rejects the domain verification request made to “/.well-known/openai-apps-challenge”. When we removed the mTLS it worked fine, domain verification succeeded.
The regular mcp flows also work fine. So, there is no misconfiguration in mTLS.
Is it by design? Can it support mTLS?
Hi!
Based on the docs this appears to be intentional. From the network documentation:
For ChatGPT apps, use mutual TLS to authenticate ChatGPT as the MCP client.
Domain verification is documented separately as a portal operation. Nothing in that submission documentation says the verifier presents the MCP client certificate. It also permits the challenge to be served from the MCP hostname or a parent hostname.
Keep mTLS enforcement on the MCP routes and make the domain-verification challenge endpoint publicly retrievable as required by the submission flow.