Hack the Route Start free Open app Identity and access
Mutual TLS
TLS in which the server also asks for the client's certificate and checks it, so both ends prove who they are.
In ordinary HTTPS only the server shows a certificate. In mutual TLS the server also sends a certificate
request in the handshake, naming the CAs it trusts; the client answers with its own certificate and signs the handshake
with the matching private key. The server checks the signature chain to a trusted CA, that the certificate is meant for
clients (extended key usage clientAuth), and that it is not on the CA's revocation list (CRL), then reads the
name in it to decide what the caller may do. The certificate is public; the identity is the private key, which is why
keys are kept in hardware and certificates kept short-lived. In nginx: ssl_verify_client on,
ssl_client_certificate (the trusted CA), ssl_crl, and $ssl_client_s_dn for the verified name.