What Is Mutual TLS (mTLS)?

Mutual TLS (mTLS) extends ordinary TLS so that both sides of a connection authenticate each other with certificates — not just the server. The client proves its identity too, so each end knows exactly who it is talking to. It is a natural fit for service-to-service communication and zero-trust architectures, where “who is calling?” must always have a cryptographic answer.

How does mTLS differ from regular TLS?#

In standard TLS, only the server presents a certificate; the client stays anonymous at the TLS layer (authenticating later via password or token). mTLS adds a second certificate exchange:

	Standard TLS	Mutual TLS
Server authenticates	Yes	Yes
Client authenticates	No (at TLS layer)	Yes, via certificate
Typical use	Public web	Service-to-service, APIs

The server verifies the client’s certificate against a trusted authority, so only holders of a valid certificate can even establish the connection — strong, mutual identity built into the transport.

Where does mTLS shine, and where does it not?#

It excels between systems you control: microservices, internal APIs, and device fleets, where issuing and rotating certificates is manageable and mutual authentication is exactly what you want. It is impractical for the public web, where distributing client certificates to arbitrary users does not scale — which is why browsers use server-only TLS plus other authentication.

mTLS brings mutual authentication to the transport layer, a pillar of zero trust. More at the Network Security hub.