What Is Mutual TLS (mTLS)?
What mutual TLS means
mTLS, or mutual TLS, is a form of TLS in which both sides of a connection present certificates, not just the server. The server proves its identity to the client as usual, and the client proves its identity to the server.
In ordinary HTTPS, only the server presents a certificate. The visitor's browser checks it, and the visitor is identified later through a password, a session cookie or another method. In mTLS, the identity check happens during the handshake itself, before any application data is exchanged.
How both sides authenticate
The server requests a client certificate during the handshake. The client responds with its certificate and proves that it holds the matching private key. The server checks the certificate against the authorities it trusts and only then completes the connection.
Client certificates are usually issued by a private certificate authority that the organization runs. They differ from the public certificates used on websites, and most consumer browsers do not hold them by default. The setup is practical where both ends are controlled by the same organization.
Because the identity check happens in the handshake, a connection without a valid client certificate is refused before any request reaches the application. This reduces the attack surface and relies less on passwords.
Where mTLS is used
mTLS is common between services in a data center or cloud, where many internal components talk to each other. Service meshes often use it to encrypt and authenticate internal traffic automatically, so each service knows which peer is calling it.
APIs that exchange sensitive data with business partners also use it. Each partner receives a client certificate, and the API accepts requests only from known certificates. Internet of things devices use it too, because each device can carry a unique certificate that is hard to copy.
Zero trust designs treat the network as untrusted and require every connection to prove identity. mTLS fits this model well, because identity is tied to a key rather than to a network address or a shared password. Traffic often passes through a proxy first, which is where TLS termination comes into play.
A payments API with partner certificates
A payments provider offers an API to several retail partners. Each partner receives a client certificate from the provider's private authority. When a partner's server calls the API, the handshake checks that certificate. A stolen API key on its own is not enough to connect, because the caller also needs the matching client certificate.
Frequently asked questions
Is mTLS more secure than ordinary TLS?
It is stronger for authentication, because both sides prove identity with keys, which is harder to fake than a password. It does not change the encryption itself. Its value depends on how well client certificates are issued, stored, rotated and revoked, and poor management can weaken it.
Is mutual TLS the same as a self-signed certificate?
No. Mutual TLS describes how the handshake works, with certificates in both directions. A self-signed certificate describes who signed it: no public authority vouched for it. Private environments often use mTLS with certificates from an internal authority rather than self-signed ones. The self-signed certificate article covers that case.