What is mTLS? | Mutual TLS | Cloudflare

TLS works using a technique called public key cryptography, which relies on a pair of keys — a public key and a private key. Anything encrypted with the public key can be decrypted only with the private key.

Therefore, a server that decrypts a message that was encrypted with the public key proves that it possesses the private key. Anyone can view the public key by looking at the domain’s or server’s TLS certificate.

In mTLS, however, both the client and server have a certificate, and both sides authenticate using their public/private key pair.

mTLS helps ensure that traffic is secure and trusted in both directions between a client and server.

This provides an additional layer of security for users who log in to an organization’s network or applications.

It also verifies connections with client devices that do not follow a login process, such as Internet of Things (IoT) devices.

mTLS prevents various kinds of attacks, including:

RFC 6125: Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS) (rfc-editor.org)


The visible face of the Internet largely consists of services that
employ a client-server architecture in which an interactive or
automated client communicates with an application service in order to
retrieve or upload information, communicate with other entities, or
access a broader network of services.

When a client communicates
with an application service using Transport Layer Security [TLS] or
Datagram Transport Layer Security [DTLS], it references some notion
of the server’s identity (e.g., “the website at example.com”) while
attempting to establish secure communication.

Likewise, during TLS
negotiation, the server presents its notion of the service’s identity
in the form of a public-key certificate that was issued by a
certification authority (CA) in the context of the Internet Public
Key Infrastructure using X.509 [PKIX].

Informally, we can think of
these identities as the client’s “reference identity” and the
server’s “presented identity” (these rough ideas are defined more
precisely later in this document through the concept of particular

In general, a client needs to verify that the server’s
presented identity matches its reference identity so it can
authenticate the communication.

Many application technologies adhere to the pattern just outlined.
Such protocols have traditionally specified their own rules for
representing and verifying application service identity.
Unfortunately, this divergence of approaches has caused some
confusion among certification authorities, application developers,
and protocol designers

CSR Decoder and Certificate Decoder | CSR Checker | Certificate Checker (certlogik.com)