Mutual TLS (mTLS) secures a service connection while authenticating both endpoints. In an Order–Payment interaction, the server presents a certificate, the client verifies it, then the client presents its own certificate for server verification. section 6.3.1
A mutual TLS connection proceeds through these steps:
- The Order service connects to the Payment service. section 6.3.1
- The Payment service presents its certificate, and the Order service verifies it. section 6.3.1
- The Order service presents its certificate, and the Payment service verifies it before accepting requests. section 6.3.1
- Both services exchange data through an encrypted channel, with each side able to identify the owner of a call. section 6.3.1
Certificate setup uses a certificate authority (CA), private keys, certificate signing requests, signed server and client certificates, and verification commands. Certificate subject fields identify attributes such as organization, organizational unit, common name, and email address; extensions can specify subject alternative names. section 6.3.2
Order and Payment services
Create a CA certificate, generate a server key and signing request for Payment, sign and verify its certificate, then repeat the process for an Order client certificate. Configure the resulting certificates for the two services so Payment requires and verifies the Order certificate. section 6.3.2 section 6.4
openssl req -x509 \ #1
-sha256 \ #2
-newkey rsa:4096 \ #3
-days 365 \ #4
-keyout ca-key.pem \ #5
-out ca-cert.pem \ #6
-subj "/C=TR/ST=EURASIA/L=ISTANBUL/O=Software/OU=Microservices/
CN=*.microservices.dev/emailAddress=huseyin@microservices.dev" #7
-nodes #8
Use the OpenSSL listing to inspect the concrete CA certificate-generation command and its identity parameters. section 6.3.2
