Mutual TLS Moves Client Identity Into the Handshake
Mutual TLS Moves Client Identity Into the Handshake An internal API can receive a perfectly encrypted TLS connection and still have no cryptographic evidence about the process at the other end. Ordinary server-authenticated TLS proves the server’s identity to the client and protects traffic in transit, but the application still needs another mechanism to identify its caller. Mutual TLS, commonly shortened to mTLS, adds certificate-based client authentication to that exchange. The server requests a client certificate, validates the presented chain according to its trust policy, and verifies a signature proving possession of the corresponding private key. The result is a transport connection associated with a cryptographic client identity before ordinary application requests are processed.