This article explains Mutual TLS (mTLS) for secure two-way authentication between client and server, including its handshake process and implementation in Kubernetes.
When you visit an HTTPS website—like your online bank—the browser and server establish an encrypted channel using asymmetric and symmetric cryptography.
Client requests the server’s certificate.
Server sends its public certificate, signed by a trusted Certificate Authority (CA).
Browser verifies the certificate against its trust store (public keys of known CAs).
Browser generates a random symmetric key, encrypts it with the server’s public key, and sends it to the server.
Server decrypts the symmetric key with its private key.
Both parties use the symmetric key to encrypt application data.
One-way TLS ensures confidentiality and server authenticity but relies on application-layer credentials (usernames, passwords) to authenticate the client.
In mTLS, both sides present certificates. This is ideal for machine-to-machine communications—such as two services exchanging confidential data—without human credentials.
In a Kubernetes cluster, you can enforce mTLS between services using service meshes like Istio or Linkerd. These platforms automate certificate issuance, rotation, and mutual authentication.
