mTLS (Mutual TLS)
TLS where both sides prove their identity with certificates, not just the server. A cornerstone of zero-trust networks and secure service-to-service communication.
What it is
In ordinary TLS only the server presents a certificate. In mutual TLS the server also requests a client certificate and verifies it against a trusted CA, so both endpoints are cryptographically authenticated. It is widely used inside service meshes and for API access where a shared secret is not strong enough.
Why it matters
- It provides strong, credential-free authentication between services in zero-trust architectures.
- It stops unauthorised clients at the transport layer, before any application logic runs.
Common mistakes
- Not rotating or revoking client certificates, leaving compromised identities valid.
- Terminating TLS at a proxy that drops the client-certificate identity before the backend sees it.
How WebInspect checks this
- WebInspect reports certificate details and whether an endpoint requires client authentication during the handshake.