Tools / Zero Trust Architecture (ZTA) Interview questions
Why do we use mutual TLS (mTLS) in Zero Trust architectures?
Standard TLS only authenticates the server to the client; the server has no cryptographic proof of who, or what, is calling it. Mutual TLS requires both sides to present certificates, so a service receiving a request can verify the calling service's identity, not just encrypt the channel.
This matters in Zero Trust because service-to-service, or east-west, traffic is no longer implicitly trusted just because it originates inside the network. mTLS ties that traffic to a verifiable workload identity, often issued through a PKI or a framework like SPIFFE, and is commonly implemented transparently via sidecar proxies in a service mesh.
Without mTLS, an attacker who reaches the internal network could impersonate a legitimate service simply by connecting to the right port; with it, they would also need a valid, trusted certificate.
More Related questions...
