What You Will Learn

• What mTLS is.
• How certificates identify services.
• The difference between keystore and truststore.
• Where mTLS fits in microservice security.
• Operational concerns for certificate rotation.

Introduction

TLS usually proves the server identity to the client.

mTLS, or mutual TLS, proves both sides:

Client verifies server certificate.
Server verifies client certificate.

mTLS Flow

sequenceDiagram
    participant A as Service A
    participant B as Service B
    A->>B: TLS handshake with client certificate
    B->>A: Server certificate
    A->>A: Verify server certificate
    B->>B: Verify client certificate
    A->>B: Encrypted API request
    B-->>A: Encrypted response

Keystore vs Truststore

Store	Purpose
Keystore	Holds this service's private key and certificate
Truststore	Holds trusted certificates or CAs

Spring Boot Server Configuration

server:
  ssl:
    enabled: true
    key-store: classpath:server-keystore.p12
    key-store-password: changeit
    key-store-type: PKCS12
    client-auth: need
    trust-store: classpath:server-truststore.p12
    trust-store-password: changeit

When to Use mTLS

• Service-to-service authentication.
• High-security internal APIs.
• Banking, insurance, healthcare, and regulated systems.
• Workloads in zero-trust networks.

Operational Checklist

• Use certificates from a managed CA.
• Rotate certificates before expiry.
• Monitor certificate expiration.
• Avoid committing keystores to source control.
• Combine mTLS with authorization.

Summary

mTLS provides strong service identity and encrypted transport. It should be paired with authorization, certificate lifecycle management, and monitoring.

Learning Path Navigation

• Series home: Spring Security Learning Path
• Previous: Secure Microservice-to-Microservice Communication
• Next: Field-Level Encryption in Spring Boot