What Is mTLS? How Mutual TLS Differs from TLS

TLS vs. mTLS at a Glance

mTLS isn't a stronger version of TLS that every website needs. Both encrypt traffic the same way. mTLS adds a second identity check for situations where the server must know exactly which client is connecting, not just that the connection is encrypted.

How the mTLS Handshake Works

mTLS follows the regular TLS handshake and adds one exchange to it:

1. The server sends its certificate, as in regular TLS, and also asks the client for a certificate.
2. The client sends its certificate and signs part of the handshake with its private key, proving it owns that certificate.
3. The server checks that the client certificate is valid and was issued by a certificate authority it trusts. If the check fails, the server refuses the connection before any data is exchanged.

For the rest of the process, see SSL/TLS Handshake: How It Works Step by Step .

Where mTLS Is Used

• APIs and connections between companies. Banks, payment providers, and business partners use mTLS so that only approved systems can call their APIs.
• Internal services. In microservice setups, services use mTLS to verify each other, often handled automatically by a service mesh.
• IoT devices. Each device gets its own certificate, so the server can recognize it without a password.
• Zero trust access. Employees' devices present certificates to reach internal systems, instead of relying on being inside the company network.

Where to Get Client Certificates

For years, many organizations used their website's SSL certificate as the client certificate in mTLS, because public SSL certificates included a client authentication permission. That's ending.

There are two options for client certificates:

• A private CA for internal systems, employees' devices, and IoT. You control which certificates are issued and which systems trust them, and you're not affected by public root program changes. GoGetSSL offers managed private CA solutions if you don't want to run your own.
• DigiCert X9 PKI for TLS for connections between organizations, such as APIs, host-to-host connections, and payment processing. It's organization-validated and includes both server and client authentication. Both sides must add the X9 root certificate to their trust store, and it isn't meant for public websites. See DigiCert X9 PKI for TLS.

Challenges of mTLS

The main difficulty is managing many certificates instead of one. Every client needs its own certificate, which has to be issued, installed, renewed before it expires, and revoked if a device is lost or a partner relationship ends. Without automation, this quickly becomes the most time-consuming part of running mTLS.