Explain how mutual TLS (mTLS) is configured between Traefik and backend services?

mTLS in Traefik applies in two distinct directions, and each is configured separately: client-to-Traefik mTLS, where Traefik verifies certificates presented by incoming clients, and Traefik-to-backend mTLS, where Traefik presents its own client certificate to the backend.

For client-facing mTLS, a router's TLS options reference a CA bundle via clientAuth, with a clientAuthType of RequireAndVerifyClientCert to enforce that every connecting client presents a certificate signed by a trusted CA before the request is even routed.

tls:
  options:
    mtls:
      clientAuth:
        caFiles:
          - /certs/client-ca.pem
        clientAuthType: RequireAndVerifyClientCert

For the backend leg, a ServersTransport resource defines the client certificate and key Traefik should present when it connects to that backend over TLS, plus the CA to validate the backend's own certificate against, and the service references that transport by name.

Both legs are independent: Traefik can require mTLS from clients while using plain TLS to the backend, or the reverse, which matters in zero-trust architectures where every hop needs its own verified identity rather than assuming the network boundary itself is trustworthy.