mTLS (mutual TLS)
Mutual TLS (mTLS) is a form of Transport Layer Security in which both sides of a connection prove their identity with certificates. In ordinary TLS, only the server shows a certificate. In mTLS, the server also asks for the client's certificate and checks it against a trusted certificate authority. The connection is encrypted and both ends are authenticated.
How it works
The client connects and checks the server certificate, as in normal HTTPS.
The server sends a certificate request.
The client sends its certificate and signs part of the handshake with its private key, proving it holds that key.
The server verifies the chain and can authorize by identity, such as
spiffe://cluster.local/ns/payments/sa/api.
In a service mesh such as Istio, a sidecar or node proxy does this for every call and rotates workload certificates automatically. Istio's default workload certificate lifetime is 24 hours, so a leaked certificate stops working within a day.
Why it matters in production
mTLS replaces trust based on IP address with trust based on identity, which matters on flat networks where any pod can reach any other. It is the base of zero trust between services. The hard part is certificate issuance and rotation, so automate it.
See also
On the One2N blog
Further reading
