Mutual TLS (mTLS)
Mutual TLS (mTLS) is a TLS handshake where the server also requests and verifies a certificate from the client, authenticating both sides instead of only the server a normal HTTPS connection authenticates. AdminKit's guide to securing an MQTT broker covers when issuing a certificate per device is worth the operational cost over username and password alone.
By AdminKit team, Netbase JSC · Updated
Mutual TLS (mTLS) extends an ordinary TLS handshake, where only the server proves its identity with a certificate, so the server also requests and verifies a certificate from the client. RFC 8446’s CertificateRequest message (Section 4.3.2) is the mechanism: if the server sends one, the client must respond with its own X.509 certificate and prove it holds the matching private key before the TLS handshake completes. This authenticates the connection itself, which is why mTLS shows up as a building block well beyond plain HTTPS — RFC 8705 defines an OAuth client authentication method built entirely on it, binding an access token to the certificate that requested it instead of a shared secret. The tradeoff is operational: every client needs a certificate issued, distributed, and rotated before expiry, more overhead than a password, but it ties access to a private key a device holds rather than a credential that can be copied or guessed, the same reasoning zero trust architectures lean on for service-to-service authentication.