# What is mutual TLS (mTLS)?

Mutual TLS means both sides of a connection present certificates, so the server proves its identity to the client and the client proves its identity to the server. In ordinary HTTPS only the server has a certificate, and the user proves who they are later with a password or a token. With mTLS the client needs a private key and a certificate issued by an authority the server trusts, which is hard to phish and easy to revoke. It is common between services in a microservice architecture, for APIs between companies, for device identity in IoT and OT, and in some zero-trust remote-access products. The costs are certificate management at scale, meaning issuing, rotating and revoking client certificates, and troubleshooting when something expires. On the network, mTLS looks like normal TLS. In TLS 1.3 the client certificate is encrypted, so a passive sensor sees that the connection exists and its handshake parameters, not which client certificate was used.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/what-is-mutual-tls

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Does a VPN encrypt everything we send?](https://netsenx.com/en/faq/does-a-vpn-encrypt-everything-we-send)
- [How do I find all SSH servers on our network, including forgotten ones?](https://netsenx.com/en/faq/how-to-find-all-ssh-servers-on-the-network)
- [How do I check which servers run an OpenSSH version affected by a new CVE?](https://netsenx.com/en/faq/how-to-check-openssh-versions-against-a-new-cve)
- [Does an SSH version banner prove a server is vulnerable?](https://netsenx.com/en/faq/does-an-ssh-version-banner-prove-a-server-is-vulnerable)
- [Can NetSenX detect threats in encrypted traffic?](https://netsenx.com/en/faq/can-netsenx-detect-threats-in-encrypted-traffic)