If you've ever tried to call a European bank's open banking endpoint directly — say, to read your own account balances programmatically — you probably hit a wall that looks something like this: HTTP 401 Unauthorized { "error" : "invalid_client" , "error_description" : "mutual TLS certificate required" } That's the eIDAS certificate gate. Under PSD2, a bank's production API is protected by mutual TLS using a qualified certificate (a QWAC ), an...