> For the complete documentation index, see [llms.txt](https://ccie-sp.gitbook.io/ccie-spv5.1-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ccie-sp.gitbook.io/ccie-spv5.1-labs/labs/mdt/dial-in-with-two-way-tls.md).
# Dial-In with two-way TLS
Continuing from the previous labs, the router should still have the collector’s cert in /misc/config/grpc/dialout/dialout.pem. Copy this to /misc/config/grpc/ca.cert.
Configure two-way TLS for the dial-in session so that the collector also must present its cert to the router for verification.
On the Ubuntu node, enable the following lines in **telegraf\_dial\_in.conf**:
Ensure these certs are still loaded via the **docker-compose.yaml** file:
Stop and start the docker container:
```
sudo docker compose down
sudo docker compose up -d
```
## Answer
```
#XR1
run cp /misc/config/grpc/dialout/dialout.pem /misc/config/grpc/ca.cert
grpc
tls-mutual
```
The **grpc tls-mutual** command requires that TLS verification is preformed in both directions. By default, only the router presents its own cert to the collector for verification during a dial-in session. But with **tls-mutual**, the collector also presents its own cert to the router for mutual TLS authentication.
The same CA cert can be used that was used for dialout. However, with dial-in mutual TLS, the router does not look at the dialout.pem file. It uses the ca.cert file to authenticate the collector. For this reason, we must copy the dialout.pem file to the ca.cert file.
```
run cp /misc/config/grpc/dialout/dialout.pem /misc/config/grpc/ca.cert
```
At this point, we likely need to restart the EMSD process.
```
process restart emsd
```
We should see that the MDT dial-in session is now **TLS-mutual** instead of just **TLS**.
## Further Reading
These labs were mostly created using the following tutorial on XRdocs:
