Comparison
Encryption in transitvsMutual TLS
Encryption in transit
you terminate TLS at the edge and then have to decide whether the internal hop after it is plaintext.
Protecting data moving over a network, in practice TLS. The interesting question is where it terminates: many systems encrypt to the load balancer and run plaintext behind it, which assumes the internal network is trusted. Zero-trust architectures reject that assumption, which is the argument for mTLS between services.
Full entry →Mutual TLS
both sides present certificates, so the server proves who it is and so does the calling service.
TLS where the client also authenticates with a certificate. It gives strong service-to-service identity with no shared secret in the request, which is why service meshes default to it. The whole difficulty is certificate lifecycle: issuance, rotation and revocation at scale, which is why it is usually adopted with a mesh rather than by hand.
Full entry →