Today, we rely on the request’s source IP to identify the originating host. However, in virtualized environments where VMs use NAT or private addresses, all outbound requests may appear to originate from the parent host’s IP. This can lead to ambiguity and misidentification of the actual VM making the request.

To address this, we should allow client certificates to serve as the primary identifier (or as a fallback) in such cases, ensuring reliable host identification even when IP-based detection is masked by NAT.