Mutual TLS (mTLS) configures TLS so both communicating parties authenticate with digital certificates before exchanging protected data. Regular TLS authenticates the server; mTLS also requires the client to prove its identity, making it useful when backend services must explicitly trust one another. section 10.1.2 section 10.5
Consider an inventory service that must distinguish an ordinary availability request from requests to increase or decrease stock. mTLS lets the service inspect the caller’s X.509 certificate and use its identity in authorization decisions. section 3.1.2
Compared with ordinary TLS, mTLS changes the trust boundary:
- Both client and server present certificates and verify that the certificates are valid and trusted. section 10.1.2
- After verification, the parties establish a shared secret and encrypt their communication. section 10.1.2
- Client certificates make setup and certificate management more complex than standard TLS. section 10.1.2
- Service meshes such as Istio can simplify deploying and managing mTLS between microservices. section 3.3 section 3.4
Alice and Bob establish trust
Alice, a client service, presents her certificate to Bob. Bob returns his certificate. Each checks whether the other certificate is valid and trusted; only then do they agree on a shared secret and begin encrypted communication. section 10.1.2
Table 10.1 A comparison between TLS and mTLS
|
TLS
|
mTLS
|
|
|---|---|---|
|
Encrypts data
|
Yes
|
Yes
|
|
Server proves identity
|
Yes
|
Yes
|
|
Client proves identity
|
No
|
Yes
|
|
Common uses
|
Web browsing
|
Service-to-service communication and secure APIs
|
|
Client certificate required
|
No
|
Yes
|
Compare TLS and mTLS by encryption, server identity, client identity, common uses, and certificate requirements. section 10.1.2
