Encryption Without Effort
Mutual TLS means both sides of a connection present and verify certificates. In a mesh, the proxies handle this automatically, so every service to service call is encrypted and authenticated without a single line of app code.
Identity, Not Just Encryption
- The control plane issues each service a short lived certificate tied to its identity.
- A proxy verifies the peer certificate before accepting a connection.
- Identity is based on the workload, not the IP, so it survives rescheduling.
This gives you zero trust networking. A service proves who it is, and policy decides whether to allow the call.
Automatic Rotation
Certificates are short lived and rotated continuously by the control plane. If a key leaks, its window of usefulness is tiny. Operators never manually distribute certs.
The Big Win
Because identity and encryption are infrastructure, security stops depending on every team remembering to configure TLS. The mesh makes encrypted, authenticated traffic the default.
Key idea
The mesh control plane issues and rotates short lived certificates so proxies establish mutual TLS automatically, giving every service a verified identity for zero trust networking.