Beyond one sided TLS
Ordinary TLS authenticates only the server to the client. For service to service traffic that is not enough; the server also needs to know the caller is a legitimate service. Mutual TLS has both sides present certificates, so each verifies the other.
How mTLS works
- Each service holds a certificate signed by a trusted internal authority.
- During the handshake both present certificates and verify them against the certificate authority.
- The verified identity in the certificate can then drive authorization decisions.
Operating mTLS at scale
The hard part is the certificate lifecycle. Certificates must be issued, distributed, and rotated automatically before they expire. A service mesh often handles this transparently, injecting sidecars that terminate mTLS so application code stays unchanged.
Key idea
Mutual TLS authenticates both ends with certificates so services trust each other, with the certificate lifecycle usually automated by a mesh.