Explain the execution flow of certificate-based mutual authentication in a service mesh under Zero Trust?

Mutual TLS in a mesh happens transparently between sidecar proxies, not inside application code, following a consistent handshake sequence.

sequenceDiagram
    participant CS as Client Sidecar
    participant SS as Server Sidecar
    participant CA as Mesh Certificate Authority

    CS->>SS: TLS ClientHello + present client SVID/cert
    SS->>CA: Validate client cert against trusted chain
    SS->>SS: Check client SPIFFE ID against authorization policy
    SS-->>CS: Present server cert
    CS->>CA: Validate server cert against trusted chain
    CS-->>SS: Handshake complete, mTLS channel established
    Note over CS,SS: Application traffic now flows encrypted

1. The client sidecar initiates the handshake and presents its own certificate, or SVID, issued by the mesh's internal certificate authority.
2. The server sidecar validates that certificate against the trusted CA chain, then checks the specific identity it represents against authorization policy, not every valid certificate is automatically allowed to call every service.
3. The server sidecar presents its own certificate in return, and the client sidecar performs the equivalent validation before trusting the connection.
4. Only once both directions of validation succeed does the encrypted mTLS channel open for application traffic.
5. Because certificates are short-lived, this handshake repeats periodically as certificates rotate, rather than being a one-time event for the life of the connection.