Intermediate LevelREST APIs & Web Services
What is Mutual TLS (mTLS) and how does it secure service-to-service REST calls?
❓ Interview Prompt: Explain mTLS, TLS handshake, X.509 client certificates, zero-trust network architecture, and service mesh security (Istio/Linkerd).
In standard TLS, only the server proves its identity via an X.509 certificate. In Mutual TLS (mTLS), both the client AND the server verify each other's digital certificates during the TLS handshake:
Zero-Trust Microservice Architecture:
1
Service A calls Service B over HTTPS.
2
Service B presents its server certificate to Service A.
3
Service B requests Service A's client certificate.
4
Service A presents its certificate signed by internal Certificate Authority (CA).
5
Connection is encrypted AND guaranteed mutually authenticated at the transport layer, eliminating unauthorized internal network access!
Code Implementation Example
typescript
import https from 'https';
import fs from 'fs';
// mTLS HTTPS Client Request
const agent = new https.Agent({
cert: fs.readFileSync('client-cert.pem'),
key: fs.readFileSync('client-key.pem'),
ca: fs.readFileSync('internal-ca-cert.pem'),
rejectUnauthorized: true
});
// Make authenticated mTLS request
// fetch('https://internal-service.local/api/v1/data', { agent });💡Executing Mutual TLS (mTLS) client request using client certificates.
🎯 Interview Key Takeaway
Mutual TLS (mTLS) enforces zero-trust microservice security by requiring both client and server to present valid X.509 certificates.
#mTLS#TLS#Zero Trust#Security#Intermediate
Back to all REST APIs & Web Services Questions→