mTLS
also: mutual TLS, two-way TLS, client certificate authentication
Mutual TLS (mTLS) is a security protocol where both the client and server authenticate each other using digital certificates, rather than just the server authenticating to the client.
mTLS extends standard TLS by requiring bidirectional certificate verification. In typical HTTPS, only the server presents a certificate to prove its identity; with mTLS, the client must also present a valid certificate that the server verifies.
This is commonly used in microservices architectures, API gateways, and zero-trust security models where both parties need to confirm they are communicating with legitimate endpoints. For example, in a Kubernetes cluster, service-to-service communication can be secured with mTLS, ensuring that only authenticated pods can communicate with each other.
Implementation typically involves certificate authorities (CAs) issuing client and server certificates, and both sides validating the peer's certificate chain during the TLS handshake. Tools like openssl, certbot, and service meshes like Istio automate mTLS certificate management on Linux systems.