mTLS in mesh
also: mutual TLS, mTLS, mutual authentication, service-to-service mTLS
Mutual TLS (mTLS) in a service mesh is a security protocol where both client and server services authenticate each other using digital certificates before establishing encrypted communication. In mesh architectures like Istio, mTLS is automatically enforced between all services without requiring application code changes.
mTLS in mesh extends standard TLS encryption by requiring bidirectional authentication. While regular TLS lets clients verify a server's identity, mTLS adds verification of the client's identity too, creating a cryptographically secure connection between services.
In a service mesh context, a control plane (like Istio) automatically issues and rotates certificates for each service, intercepts traffic via sidecar proxies, and validates certificates on both ends. This means developers don't embed certificates in application code.
Example: In an Istio mesh, when Service A calls Service B, the sidecar proxy for A presents its certificate to B's sidecar, which verifies it. B's sidecar presents its certificate back to A's sidecar. Both proxies confirm identity before the request proceeds, all transparently to the applications.