TLS Client Authentication

In a Zero trust network nothing is trusted by default. When something calls our API, how can we be sure the caller is the right one? With mutual TLS or simply mTLS, we validate parties on the other end of the connection are who they claim to be. Mihaita Tinta

• Server and client validates each other's certificates (Client certificate verfication is needed).
• CA Authority validates the certificates
• Two way net/sec/PKI/TLS

By default the TLS protocol only proves the identity of the server to the client using X.509 certificate and the authentication of the client to the server is left to the application layer.

For Debugging issues use openssl

Links

1. Implementation of mTLS in NodeJS
2. Implementation of mTLS in Spring Boot
3. mTLS connection using curl
4. Implementation of mTLS in nGInx

Generate Self Signed root CA using openssl

Reference

1. How to enable mutual TLS in a Spring Boot Application | by Salar Ahmadi | Medium Following
2. A simple mTLS guide for Spring Boot microservices | by Mihaita Tinta | ING Hubs Romania | Medium
3. X.509 Authentication in Spring Security | Baeldung
4. TLS Setup in Spring | Baeldung
5. Mutual TLS Authentication (mTLS) De-Mystified | by John Tucker | codeburst Following
6. https://cloud.google.com/load-balancing/docs/mtls

mTLS in browser

1. What is mTLS? | Mutual TLS | Cloudflare

Github Project

1. GitHub - joutwate/mtls-springboot: Mutual TLS authentication with SpringBoot example
2. GitHub - drGrove/mtls-cli: A short-lived certificate tool based on the Zero Trust network model

mTLS in Linux

1. Install mTLS Client Certificate on Different OS

mTLS in mac

1. https://stackoverflow.com/questions/43665243/invalid-self-signed-ssl-cert-subject-alternative-name-missing

mTLS in Chrome

velmuruganv

mTLS in nGinx

• Client Certificate Authentication - NGINX Ingress Controller

mTLS Security

mTLS - CA workflow