mTLS
TLS where both client and server present certificates, so each side authenticates the other cryptographically.
In mTLS the server requests a client certificate during the handshake and verifies it against a trusted CA. The client proves possession of the private key, so identity is bound to the connection rather than to a bearer secret that can be copied.
It is the standard for service-to-service authentication in zero trust networks and service meshes, for agents talking to a backend (EDR, log shippers), and for sender-constrained OAuth tokens (RFC 8705). SPIFFE issues short-lived workload certificates exactly so mTLS can be automatic.
Hard parts are operational: issuing and rotating certificates at scale, revocation, deciding authorisation from the certificate (a valid cert proves who, not what they may do), and TLS-terminating proxies that strip the client identity unless it is forwarded and trusted carefully.
Learn it properly
Compared
Also used in
- How to think like a security engineerSecEng · Foundations of Security EngineeringFree
- What happens when you log inSecEng · Foundations of Security EngineeringFree
- Identity: authentication, authorisation and tokensSecEng · Foundations of Security EngineeringFree
- Secure design principles that still holdSecEng · Foundations of Security EngineeringFree
- Segmentation and zero trustSecEng · Network & Infrastructure SecurityFree
- DDoS and WAF fundamentalsSecEng · Network & Infrastructure SecurityFree
- API securitySecEng · Application Security & DevSecOpsFree
- Post-quantum migrationSecEng · Applied cryptography engineeringFree