Protocols & Standards
What Is Mutual TLS (mTLS)?
Mutual TLS (mTLS) is a TLS connection in which both parties authenticate with certificates: the server proves its identity as usual, and the client presents its own certificate too. Instead of passwords or API keys, each side trusts the other because its certificate chains to an accepted CA — which makes mTLS the backbone of service-to-service and machine-to-machine authentication.
How mTLS differs from normal TLS
In everyday HTTPS only the server has a certificate; the client is anonymous at the transport layer and authenticates later with a password or token. In mTLS the server additionally requests a client certificate during the handshake and verifies it against a configured CA. Both identities are cryptographically verified before any application data flows.
Where mTLS is used
Microservice meshes (Istio, Linkerd) encrypt and authenticate every pod-to-pod connection with short-lived mTLS certificates. API providers use mTLS for high-value integrations (open banking, healthcare). Enterprises use client certificates for 802.1X network access, VPNs and zero-trust access — and IoT fleets use per-device certificates for the same reason: a certificate can be revoked individually, a shared secret cannot.
The operational catch: certificate lifecycle
mTLS moves the hard problem from "storing passwords" to "operating a PKI": every client needs a certificate, certificates expire, and an expired or unrevocable client certificate is an outage or a breach. Successful mTLS deployments automate issuance and renewal (ACME, SPIFFE, or an internal CA like ADCS) and monitor expiry — the failure mode is almost always lifecycle, not cryptography.
Try it yourself — free tools
- Certificate Checker — inspect client and server certificates — EKUs, expiry and chain
- Key Matcher — verify a client certificate matches its private key before deploying it
- CSR Generator — create CSRs for client certificates
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- TLS HandshakeThe negotiation that starts every HTTPS connection — where certificates are verified and session keys agreed.
- Certificate Lifecycle Management (CLM)The discipline — and tooling — that keeps hundreds of certificates issued, deployed, renewed and revoked without outages.
- Certificate Chain (Intermediate Certificates)How leaf, intermediate and root certificates link together — and why a missing intermediate breaks TLS.
- Browse all terms →