--- title: mTLS (Mutual TLS): How It Works, with Diagram | daily.dev description: Mutual TLS (mTLS) extends standard TLS by requiring both client and server to authenticate each other with X.509 certificates, rather than just the server... canonical: https://daily.dev/posts/mtls-mutual-tls-how-it-works-with-diagram-27dgscnra twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: mTLS (Mutual TLS): How It Works, with Diagram | daily.dev og:description: Mutual TLS (mTLS) extends standard TLS by requiring both client and server to authenticate each other with X.509 certificates, rather than just the server... og:url: https://daily.dev/posts/mtls-mutual-tls-how-it-works-with-diagram-27dgscnra og:image: https://api.daily.dev/og/posts/27dgScNRa.png og:image:alt: mTLS (Mutual TLS): How It Works, with Diagram og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # mTLS (Mutual TLS): How It Works, with Diagram **[ngrok Blog](https://daily.dev/sources/ngrok)** · 10 min read · 0 upvotes · 0 comments ## Summary Mutual TLS (mTLS) extends standard TLS by requiring both client and server to authenticate each other with X.509 certificates, rather than just the server proving its identity. The handshake adds a CertificateRequest and client certificate exchange step before a shared session key is derived. Common use cases include microservices, service meshes (Istio, Linkerd), API gateways, zero trust networks, IoT devices, and webhooks, while browser-to-server auth typically still relies on OAuth/OIDC. Challenges include certificate lifecycle management, revocation via OCSP/CRL, CA key protection, and slightly higher handshake latency. A walkthrough shows configuring mTLS at the ngrok edge using its terminate-tls Traffic Policy action. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What's the difference between TLS and mTLS? Standard TLS only authenticates the server to the client, encrypting the connection but leaving the client unverified. Mutual TLS (mTLS) requires both the client and server to present and verify X.509 certificates signed by a trusted Certificate Authority before any application data is exchanged, making it suited for machine-to-machine communication where there's no human login to rely on. _Comparing TLS and mTLS for a service-to-service design? Find deeper breakdowns on daily.dev._ ### How does the mTLS handshake work step by step? The mTLS handshake has five steps: the client sends a ClientHello, the server replies with a ServerHello plus its certificate and a CertificateRequest, the client sends back its own certificate, both sides verify each other's certificate against a trusted CA, and finally they derive a shared session key (typically via ECDHE) to encrypt all further communication. _daily.dev surfaces handshake and security-protocol deep dives for engineers building mTLS setups._ ### Why is certificate revocation considered a weak point in mTLS? Revocation is difficult because if a private key is compromised, the certificate must be invalidated quickly, and the two standard mechanisms, OCSP (real-time CA queries) and CRL (periodic downloaded revocation lists), both add operational complexity or latency. Many production mTLS setups instead favor short-lived certificates that expire every few hours or days to limit the blast radius without depending on revocation infrastructure. _Engineers weighing certificate rotation versus revocation strategies can track related guidance on daily.dev._ ## Similar posts on daily.dev - [Mutual TLS \(mTLS\) Authentication A Complete Guide](https://daily.dev/posts/mutual-tls-mtls-authentication-a-complete-guide-s8a9whgm7) · GitGuardian · 0 upvotes · 0 comments - [A visual guide to Public Key Infrastructure \(PKI\) Part 2 — When the Server Needs to Trust the Client](https://daily.dev/posts/a-visual-guide-to-public-key-infrastructure-pki-part-2-when-the-server-needs-to-trust-the-client-u3icrtiag) · Towards Dev · 0 upvotes · 0 comments - [Mutual TLS in SingleStore](https://daily.dev/posts/mutual-tls-in-singlestore-07wanpuno) · SingleStore · 0 upvotes · 0 comments - [Enhance Integration Security with mTLS for Salesforce and MuleSoft](https://daily.dev/posts/enhance-integration-security-with-mtls-for-salesforce-and-mulesoft-nu5b21eb4) · Salesforce Developers Blog · 0 upvotes · 0 comments - [mTLS vs OAuth 2.0 for Service-to-Service Authentication: A Technical Comparison](https://daily.dev/posts/mtls-vs-oauth-2-0-for-service-to-service-authentication-a-technical-comparison-jsnjjcx35) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#devtools](https://daily.dev/tags/devtools) [View this post on daily.dev](https://daily.dev/posts/mtls-mutual-tls-how-it-works-with-diagram-27dgscnra) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"mTLS (Mutual TLS): How It Works, with Diagram","url":"https://daily.dev/posts/mtls-mutual-tls-how-it-works-with-diagram-27dgscnra","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mtls-mutual-tls-how-it-works-with-diagram-27dgscnra"},"datePublished":"2026-08-23T07:21:26.804Z","dateModified":"2026-08-23T07:28:03.219Z","description":"Mutual TLS (mTLS) extends standard TLS by requiring both client and server to authenticate each other with X.509 certificates, rather than just the server...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc466ebae9ba0f9759a9ca3dcbbf3461?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc466ebae9ba0f9759a9ca3dcbbf3461?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mtls-mutual-tls-how-it-works-with-diagram-27dgscnra","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"mTLS (Mutual TLS): How It Works, with Diagram"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/mtls-mutual-tls-how-it-works-with-diagram-27dgscnra#faq","mainEntity":[{"@type":"Question","name":"What's the difference between TLS and mTLS?","acceptedAnswer":{"@type":"Answer","text":"Standard TLS only authenticates the server to the client, encrypting the connection but leaving the client unverified. Mutual TLS (mTLS) requires both the client and server to present and verify X.509 certificates signed by a trusted Certificate Authority before any application data is exchanged, making it suited for machine-to-machine communication where there's no human login to rely on. Comparing TLS and mTLS for a service-to-service design? Find deeper breakdowns on daily.dev."}},{"@type":"Question","name":"How does the mTLS handshake work step by step?","acceptedAnswer":{"@type":"Answer","text":"The mTLS handshake has five steps: the client sends a ClientHello, the server replies with a ServerHello plus its certificate and a CertificateRequest, the client sends back its own certificate, both sides verify each other's certificate against a trusted CA, and finally they derive a shared session key (typically via ECDHE) to encrypt all further communication. daily.dev surfaces handshake and security-protocol deep dives for engineers building mTLS setups."}},{"@type":"Question","name":"Why is certificate revocation considered a weak point in mTLS?","acceptedAnswer":{"@type":"Answer","text":"Revocation is difficult because if a private key is compromised, the certificate must be invalidated quickly, and the two standard mechanisms, OCSP (real-time CA queries) and CRL (periodic downloaded revocation lists), both add operational complexity or latency. Many production mTLS setups instead favor short-lived certificates that expire every few hours or days to limit the blast radius without depending on revocation infrastructure. Engineers weighing certificate rotation versus revocation strategies can track related guidance on daily.dev."}}]} ```