> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paxos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting FIX mTLS Connectivity

> Diagnose and resolve mTLS certificate and connection issues for FIX clients.

Paxos uses mTLS (mutual TLS) to secure FIX server connections.
During onboarding, you provide your certificate — signed by yourself or your CA — and Paxos deploys it on the server side.
Use the steps below to diagnose connectivity issues.

## Prerequisites

Confirm you have the following files from Paxos onboarding before proceeding:

| File                          | Description                                            |
| ----------------------------- | ------------------------------------------------------ |
| `private.pem`                 | Your private key                                       |
| `your_signed_certificate.crt` | Your client certificate, signed by you or your CA      |
| `your_CA_certificate.crt`     | The CA certificate that signed your client certificate |

## 1. Verify Network Connectivity

Test basic connectivity to confirm the server and port are reachable:

```bash theme={null}
telnet itbit-{clientname}.exchange.gfix.prod.itbitprod.com 4199
```

If the connection fails, check for:

* DNS resolution failures or an incorrect server address
* Firewall rules blocking outbound traffic on port `4199`
* Your IP address not being allowlisted (see [Check Your External IP](#3-check-your-external-ip))

## 2. Verify Server Certificate

Use OpenSSL to confirm the server returns a certificate during the connection attempt:

```bash theme={null}
FIXENV=prod FIXNAME={clientname} openssl s_client -crlf \
  -connect itbit-$FIXNAME.exchange.gfix.$FIXENV.itbitprod.com:4199 \
  -showcerts \
  -servername itbit-$FIXNAME.exchange.gfix.$FIXENV.itbitprod.com
```

If the output contains `no peer certificate available`, contact [Support](https://support.paxos.com).

## 3. Check Your External IP

Your external IP address may need to be added to the Paxos allowlist. Find it with:

```bash theme={null}
curl ifconfig.io
```

Contact [Support](https://support.paxos.com) to confirm your IP is allowlisted.

## 4. Configure Stunnel

If your FIX client does not support native TLS, use [Stunnel](https://www.stunnel.org/) as a TLS proxy.
Below is a sample configuration:

```ini theme={null}
client = yes
foreground = yes
output = /log_path/filename.log
; Enable verbose logging if required
; debug = 7

[fix-itbit-exchange-prod]
client = yes
accept = 127.0.0.1:4198
cert = your_signed_certificate.crt
key = private.pem
connect = itbit-{clientname}.exchange.gfix.prod.itbitprod.com:4199
CAfile = itbitprod_prod_root_ca.crt
verifyChain = yes
checkHost = itbit-{clientname}.gfix-exchange.prod.itbitprod.com
```

To enable verbose debug logging, uncomment `debug = 7`.

<Tip>
  Stunnel v4.54 or higher is required. See [Verify Software Versions](#10-verify-software-versions) to check your installed version.
</Tip>

## 5. Validate Your Certificate

Confirm your signed certificate validates against your CA:

```bash theme={null}
openssl verify -CAfile your_CA_certificate.crt your_signed_certificate.crt
```

A successful validation returns `your_signed_certificate.crt: OK`.

## 6. Test the Connection

Run a full mTLS connection test using all three certificate files:

```bash theme={null}
openssl s_client \
  -connect itbit-{clientname}.exchange.gfix.prod.itbitprod.com:4199 \
  -key private.pem \
  -cert your_signed_certificate.crt \
  -CAfile your_CA_certificate.crt
```

Review the output for handshake errors or certificate validation failures.

## 7. Verify File Format

Each certificate and key file must use proper PEM formatting.
Confirm each file contains the correct `BEGIN` and `END` markers:

| File                          | Expected Header                   | Expected Footer                 |
| ----------------------------- | --------------------------------- | ------------------------------- |
| `your_signed_certificate.crt` | `-----BEGIN CERTIFICATE-----`     | `-----END CERTIFICATE-----`     |
| `your_CA_certificate.crt`     | `-----BEGIN CERTIFICATE-----`     | `-----END CERTIFICATE-----`     |
| `private.pem`                 | `-----BEGIN RSA PRIVATE KEY-----` | `-----END RSA PRIVATE KEY-----` |

Missing or malformed headers indicate a corrupted or incorrectly formatted file.

## 8. Match Certificate and Private Key

Verify the certificate and private key are a matched pair by comparing their MD5 checksums — both values must be identical:

```bash theme={null}
openssl x509 -noout -modulus -in your_signed_certificate.crt | openssl md5
openssl rsa -noout -modulus -in private.pem | openssl md5
```

If the checksums do not match, the certificate and private key were not generated together.
Locate the private key file that was generated alongside your certificate, or generate a new key pair and resubmit the certificate to Paxos.

## 9. Check Certificate Expiration

Verify your certificate has not expired:

```bash theme={null}
openssl x509 -noout -in your_signed_certificate.crt -enddate
```

Contact [Support](https://support.paxos.com) to renew an expired certificate.

## 10. Verify Software Versions

Confirm you are running supported versions of Stunnel and OpenSSL:

```bash theme={null}
stunnel -version
openssl version
```

**Requirements:**

* Stunnel v4.54 or higher
* OpenSSL with TLS 1.2 support or higher

> Questions? Contact [Support](https://support.paxos.com).