{"id":90256,"date":"2026-09-03T21:54:14","date_gmt":"2026-09-03T20:54:14","guid":{"rendered":"https:\/\/www.n-able.com\/?p=90256"},"modified":"2026-09-03T22:32:39","modified_gmt":"2026-09-03T21:32:39","slug":"firewall-configuration-guide-for-coves-move-to-mutual-tls","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/de\/blog\/firewall-configuration-guide-for-coves-move-to-mutual-tls","title":{"rendered":"Firewall Configuration Guide for Cove\u2019s Move to Mutual TLS"},"content":{"rendered":"

A Disclaimer Before You Begin<\/h2>\n

This guide is provided for reference to help you get started and is not official documentation from your firewall vendor. Menu names, steps, and settings may vary by firmware version or configuration. Always consult your firewall vendor’s documentation or support team for guidance specific to your environment before making changes.<\/p>\n

Stopping the Man in the Middle<\/h2>\n

Man-in-the-middle (MITM) attacks let an attacker sit between two systems, intercept their traffic, and read or alter it without either side noticing. On an unprotected connection, that means backup traffic \u2014 including credentials and business data \u2014 could be exposed in transit.<\/p>\n

That’s why we’re upgrading the connection between Backup Manager and the N-able cloud from one-way TLS to mutual TLS (mTLS), which adds client-side certificate authentication on top of encryption. Both sides now verify each other’s identity before any data moves, closing the gap MITM attacks rely on and keeping backup traffic genuinely end to end (E2E) encrypted with no proxy able to decrypt and re-encrypt it in the middle.<\/p>\n

Preparing for the Move to mTLS<\/h2>\n

Backup Manager will be moving to mTLS which will validate the full TLS certificate chain on its connections. There is no client-side setting to disable this check, so any firewall or proxy that re-signs TLS (SSL\/TLS inspection, DPI-SSL, HTTPS content inspection) will break backups unless the relevant Cove domains are explicitly excluded from that inspection. <\/p>\n

Therefore, Cove must be excluded from TLS inspection before November 2nd, 2026<\/strong>. To help you get started, we’ve put together this configuration guide for the most commonly used firewalls.<\/p>\n

For every firewall below, the fix is the same in principle: add cloudbackup.management and *.cloudbackup.management to that firewall’s TLS\/SSL inspection exclusion or allow list, using domain or SNI matching rather than IP matching.<\/p>\n

Quick Reference<\/h2>\n

Domains to exclude on every firewall that supports domain\/SNI-based TLS exceptions:<\/p>\n