Mutual TLS Makes Client Identity Part of the Connection
A service can receive perfectly encrypted traffic from a client it should never have trusted. Ordinary server-authenticated TLS protects the channel and lets the client validate the server, but it does not automatically give the server a cryptographic identity for the caller. In machine-to-machine systems, that missing property is often filled by mutual TLS. Mutual TLS, commonly shortened to mTLS, extends the TLS handshake so that the server requests a certificate from the client. The client proves possession of the corresponding private key, and the server validates the presented certificate against an accepted trust policy. When that policy is tied to an application identity, the connection carries more than confidentiality and integrity: it also carries evidence about the peer that opened it.