Comparison
Mutual TLSvsZero-trust networking
Mutual TLS
both sides present certificates, so the server proves who it is and so does the calling service.
TLS where the client also authenticates with a certificate. It gives strong service-to-service identity with no shared secret in the request, which is why service meshes default to it. The whole difficulty is certificate lifecycle: issuance, rotation and revocation at scale, which is why it is usually adopted with a mesh rather than by hand.
Full entry →Zero-trust networking
being inside the network gets a caller nothing; every call is authenticated and authorised on its own merits.
Designing on the assumption that the network is hostile, so location confers no privilege and each request carries and proves identity. It is the answer to the flat internal network where one compromised host reached everything. In practice it is workload identity plus mutual TLS plus per-call authorisation, and the hard part is never the cryptography — it is enumerating who is allowed to call what, which nobody has written down.
Full entry →