Mutual TLS
also called mTLS, Client Certificate Authentication
TLS in which both ends present certificates, so the server authenticates the client cryptographically rather than by a shared secret.
Ordinary TLS authenticates the server to the client. mTLS adds the reverse: the client presents a certificate the server validates against a trusted CA.
Where it matters architecturally: service-to-service authentication in a zero-trust estate, where it removes shared secrets entirely, and high-value partner integrations where a bearer token is considered insufficient.
The cost is certificate lifecycle. Every workload needs a certificate, issued, distributed, rotated and revoked — which is precisely the burden a service mesh or SPIFFE/SPIRE automates, and precisely why hand-managed mTLS becomes an outage source. Short-lived certificates (hours) are safer than long-lived ones and only practical with automation.
Revocation is the weak point: CRLs and OCSP are unreliable in practice, so short lifetimes are the real control.