cryptography-passwords • Expert

Mutual TLS (mTLS) & Zero Trust Service-to-Service Authentication

Standard TLS authenticates only the server to the client. Mutual TLS (mTLS) requires both client and server to present and verify X.509 cryptographic certificates issued by a private Certificate Authority (CA), enforcing Zero Trust in microservices.

Intuitive Mental Model

The Secret Agent Handshake: In standard TLS, the agent asks to see the handler's badge. In mTLS, both the agent and the handler must present valid CIA credentials to each other before speaking a single word.

Architecture Blueprint & CodeProduction Standard

// Node.js HTTPS Server Enforcing mTLS Client Certificates:
import https from 'https';
import fs from 'fs';

const options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem'),
  ca: fs.readFileSync('internal-ca.pem'), // Trusted Private CA
  requestCert: true,                      // Demand client certificate
  rejectUnauthorized: true               // Reject if cert invalid or untrusted
};

https.createServer(options, (req, res) => {
  const clientCert = (req.socket as any).getPeerCertificate();
  res.end(`Authenticated Service: ${clientCert.subject.CN}`);
});

Key Architectural Takeaways

•Cryptographic Identity: Every microservice in the service mesh (Istio, Linkerd) has a cryptographic identity tied to its private key.
•Zero Network Trust: Even if an attacker breaches the internal VPC network, they cannot spoof RPC calls without a valid X.509 certificate.

Common Architectural Pitfall

Relying solely on internal VPC private IP addresses for microservice security without cryptographic transport authentication.

Production Best Practice

Enforce mTLS with automated certificate rotation across all internal RPC channels.

Next: OAuth 2.0 Scopes, Claims & Principle of Least Privilege