TLS & PKI

What is mTLS?

Also known as: Mutual TLS

Definition

Mutual TLS (mTLS) is a variation of TLS where both the client and server authenticate each other using X.509 certificates, commonly used in zero-trust networks and service meshes.

Mutual TLS (mTLS) is a security protocol that extends the standard Transport Layer Security (TLS) handshake to require bidirectional certificate verification. In a typical TLS connection, only the server presents a certificate to prove its identity. mTLS requires the client to do the same, ensuring that both parties are authenticated before any data exchange.

The handshake for mTLS follows the same flow as TLS but adds a CertificateRequest message from the server. After the server sends its certificate, it asks the client for one. The client responds with its own certificate, which the server validates against a trusted root or intermediate CA. Both sides then proceed with key exchange and encryption as usual. This mutual authentication prevents man-in-the-middle attacks on both ends and allows each side to verify the identity of the other.

mTLS is a foundational component in zero-trust security architectures, where no entity is trusted by default. It is widely used inside service meshes such as Istio, Linkerd, and Consul Connect to secure inter-service communication. Platforms like SPIFFE/SPIRE provide automated certificate issuance and rotation for mTLS in dynamic environments. Adoption has grown with the shift to microservices and the need for encrypted, authenticated, and authorized traffic within clusters.

Key facts

  • Both client and server must present valid X.509 certificates during handshake.
  • Provides mutual authentication in addition to encryption.
  • Typically uses certificate authorities (CAs) unique to the organization or mesh.
  • Eliminates reliance on network-level security for service-to-service trust.
  • Often combined with short-lived certificates and automated rotation.

How it works in practice

In a Kubernetes cluster running Istio, each Envoy sidecar proxy connects to others using mTLS. When service A calls service B, Envoy on A initiates a TLS connection to Envoy on B. The destination Envoy presents a certificate signed by Istio's CA, and the source Envoy presents its own. Both verify each other's identity against the mesh CA. This ensures that only authorized services can talk, even if an attacker has network access.

Related terms

TLS X.509 Certificate Certificate Authority Service Mesh SPIFFE Zero Trust Public Key Infrastructure (PKI)

References

More in TLS & PKI

ACME Protocol

ACME (Automated Certificate Management Environment) is a protocol that automates the issuance, renewal, and revocation of TLS certificates, defined in RFC 8555.

Certificate Authority

A Certificate Authority (CA) is a trusted entity that issues digital certificates after verifying that the requester controls the domain or identity named in the certificate.

Certificate Chain

A certificate chain is an ordered list of certificates, starting with the server certificate and ending with a root CA, that a client validates to establish trust in the server's identity.

Certificate Pinning

A security technique where an application trusts only a specific, pre-selected certificate or public key for a given server, bypassing the standard chain of trust.

Cipher Suite

A cipher suite is a named set of cryptographic algorithms negotiated during a TLS handshake, specifying key exchange, authentication, encryption, and integrity protection for secure communications.

Domain Validation

Domain Validation (DV) is the lowest level of certificate validation used in TLS/SSL, where the certificate authority verifies only that the applicant controls the domain name, typically via an HTTP or DNS challenge.

ECH

Encrypted Client Hello (ECH) is a TLS extension that encrypts the Client Hello message, including the Server Name Indication (SNI), to prevent on-path observers from learning the target hostname during the handshake.

Extended Validation

Extended Validation (EV) is the highest level of TLS certificate assurance, requiring the certificate authority to perform rigorous, human-verified checks on the legal identity and operational existence of the requesting organization before issuance.

HSTS

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that forces browsers to interact with a website only over HTTPS, preventing downgrade attacks and cookie hijacking.

Intermediate Certificate

An intermediate certificate is a subordinate CA certificate signed by a root CA, used to sign end-entity certificates and enable path validation while the root remains offline.

Who Is Online

In total there are 67 users online: 0 registered, 59 guests and 8 bots.

Most users ever online was 5,555 on 17 Jul 2026, 3:23 am.

Bots: AhrefsBot Applebot Baiduspider Bingbot Other Bot Other Crawler PetalBot SemrushBot

Users active in the past 15 minutes. Total registered members: 369