> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/use-chaos-engineering/infrastructure/types/ddcr/mtls-support.md).

# Use mTLS with DDCR and Discovery Agent

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* [What is mTLS?](/harness-ai/use-harness-platform/delegates/delegate/secure-delegates/delegate-mtls-support.md)
* [What is DDCR?](/resilience-testing/chaos-engineering/use-chaos-engineering/infrastructure/infrastructures.md#what-is-ddcr)

This topic describes how you can configure mTLS with DDCR and Discovery Agent.

Chaos runner supports token-based authentication with the Harness Platform. If you want to add another authentication on top of Harness authentication, you can [enable mTLS](/harness-ai/use-harness-platform/delegates/delegate/secure-delegates/delegate-mtls-support.md) for the account.

### DDCR <a href="#ddcr" id="ddcr"></a>

To configure mTLS in the DDCR, create a Kubernetes secret with the certificate and key in the target cluster and provide the following details.

![](/files/QReaQ81hNELlG8szwDhH)

If you don't want to create Kubernetes secrets in multiple clusters, you can [install the agent proxy](/resilience-testing/chaos-engineering/use-chaos-engineering/infrastructure/types/ddcr/proxy-support.md#installation) (aka Chaos Runner agent proxy) with mTLS key and certificate and provide the proxy URL in proxy setting.

![](/files/5sB0s83qqakBno8o5NTA)

### Discovery Agent <a href="#discovery-agent" id="discovery-agent"></a>

To configure mTLS in the Discovery Agent, create a Kubernetes secret with the certificate and key in the target cluster and provide the following details.

![](/files/QReaQ81hNELlG8szwDhH)

If you don't want to create Kubernetes secrets in multiple clusters, you can install the Chaos Runner agent proxy with mTLS key and certificate and provide the proxy URL in proxy setting.

![](/files/5sB0s83qqakBno8o5NTA)
