Definition
mTLS (Mutual TLS) is a TLS handshake where both the client and the server present and validate certificates — distinguished from standard TLS where only the server is authenticated.
In more depth
mTLS is widely used in machine-to-machine authentication, OAuth token binding (sender-constrained tokens), and zero-trust microservices. Service meshes (Istio, Linkerd) typically use mTLS automatically between services.
In OAuth, mTLS-bound tokens are the alternative to DPoP — the token is cryptographically bound to the client TLS certificate. Required at higher FAPI assurance levels.
Want the work, not just the definition?