Mutual TLS (mTLS) is an extension of the standard TLS (Transport Layer Security) protocol in which both parties in a connection — both the client and the server — present and verify X.509 certificates during the TLS handshake. This provides bidirectional authentication: not only does the client verify the server's identity, but the server also verifies the client's identity before accepting the connection.
Standard TLS vs. mTLS
In standard TLS (the HTTPS used by browsers), only the server presents a certificate. The browser verifies that the certificate was signed by a trusted Certificate Authority and that it matches the domain. The server authenticates no further than confirming the client can complete the TLS handshake — there is no client certificate requirement. This is appropriate for public-facing web services where any client should be able to connect.
In mTLS, the server also requires the client to present a valid certificate. The server only accepts connections from clients whose certificates are signed by a known, trusted CA. This means that even if a network is compromised, an attacker cannot communicate with services — they do not have a valid client certificate.
mTLS in microservices
In a microservices architecture running on Kubernetes, hundreds of services communicate with each other continuously. Without mTLS, any pod that can reach the network can send requests to any service. With mTLS enforced by a service mesh, each service has a unique cryptographic identity (a certificate tied to its workload identity), and will only accept connections from services presenting certificates from the same trust domain. Lateral movement after an initial compromise becomes nearly impossible.
Performance considerations
mTLS adds a small overhead to connection establishment — the additional certificate exchange adds a few milliseconds to the TLS handshake. For long-lived connections (most microservice communication), this is negligible. Connection multiplexing (HTTP/2) further reduces the impact by reusing established connections for multiple requests.