Web Security & OWASP (50 Qs)•Part 3: Authentication, Authorization & Cryptographic Standards (26 - 35)
Mutual TLS (mTLS) & Cryptographic Service Identity: PKI, X.509 cert validation, and SPIFFE IDs.
Standard TLS vs. Mutual TLS (mTLS)
In standard HTTPS, only the server presents an X.509 certificate to prove its identity to the client. In Mutual TLS (mTLS), both the client and server cryptographically validate each other's certificates against a trusted Certificate Authority (CA).
less
Standard TLS:
[ Client ] --------------------(Verifies Server Cert)-------------------> [ Server ]
Mutual TLS (mTLS):
[ Client Pod ] <---(Verifies Server Cert)---(Verifies Client Cert)---> [ Server Pod ]
Both sides have cryptographically verified identity before transmitting a single byte!
SPIFFE IDs (Secure Production Identity Framework for Everyone)
In modern microservice meshes (Istio, Linkerd), mTLS certificates encode a standard SPIFFE ID in the X.509 Subject Alternative Name (SAN):
ruby
spiffe://prod-cluster.example.com/ns/billing/sa/payment-worker
When the payment worker calls the banking service, the banking service inspects the SAN attribute in the TLS handshake. It does not need passwords, API tokens, or IP allowlists; the identity is verified at the cryptographic transport layer.