mTLS

mTLS (mutual TLS) extends ordinary TLS — where only the server proves its identity — so that the client presents a certificate too. Both sides authenticate each other cryptographically, which is why it underpins zero-trust service-to-service communication.

Worked example: in a service mesh, every service calls another over mTLS: the caller verifies the callee’s certificate AND proves its own, so a rogue pod without a valid cert cannot talk to anything. Gotcha: the hard part is certificate lifecycle — issuing, rotating, and revoking certs for every service at scale — which is exactly the job a service mesh or an internal CA automates; hand-managing mTLS certs quickly becomes unmanageable.