mutual TLS (mTLS) authentication implementieren
mTLS requires both Client und Server in present certificates, providing strong bidirectional authentication ohne passwords. Gemein in Dienst-in-Dienst und zero-trust architectures.
- 1
In standard TLS, only the server proves its identity. In mTLS, the client also presents a certificate, verified by the server. This eliminates passwords for service-to-service communication. The server is configured to "require and verify" client certificates.
- 2 RSA-Tool →
Erzeugen a client key pair and create a CSR. The internal CA signs it and returns a client certificate. The client stores both the certificate and private key.
- 3 Hash-Rechner →
Verify the client certificate chain against the internal CA's root. The server must trust this CA (configured as a trusted CA for client verification).
- 4
Configure the server to require client certificates (nginx: ssl_verify_client on; ssl_client_certificate ca.crt). Map certificate DNs to authorization roles. For zero-trust, use short-lived certificates (hours, not years) with automated rotation via an internal CA or SPIFFE/SPIRE.
Häufige Fragen
- When should I use mTLS?
- Service-to-service communication (microservices, APIs), zero-trust networks, and high-security client connections (financial APIs, IoT device management). It is overkill for public web apps where user authentication is handled at the application layer.
- How do I rotate client certificates?
- Use short-lived certificates (e.g., 24 hours) with automated issuance. The client requests a new certificate before the old one expires, authenticated by the current valid certificate. Tools like cert-manager (Kubernetes) or SPIFFE automate this.