What is mutual TLS (mTLS)?

Mutual TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. means both sides of a connection present certificates, so the server proves its identity to the client and the client proves its identity to the server. In ordinary HTTPS only the server has a certificate, and the user proves who they are later with a password or a token. With mTLS the client needs a private key and a certificate issued by an authority the server trusts, which is hard to phish and easy to revoke. It is common between services in a microservice architecture, for APIs between companies, for device identity in IoT and OTOT: operational technology. The computers that run machines, production lines, building systems and utilities., and in some zero-trust remote-access products. The costs are certificate management at scale, meaning issuing, rotating and revoking client certificates, and troubleshooting when something expires. On the network, mTLS looks like normal TLS. In TLS 1.3 the client certificate is encrypted, so a passive sensor sees that the connection exists and its handshake parameters, not which client certificate was used.

← All 40 questions on Encryption and encrypted trafficAll topics