[ec109685]

I wish more things / ecosystems supported mTLS. Then you aren’t storing any long lived tokens. You exchange per instance metadata with key material to generate client tls certs that are then used to auth server calls. The certs have a short lifetime.

[csears]

The same thing occurred to me while reading this.

I suspect mTLS adoption has been slow because it’s easier to reason about authentication when the mechanics are “closer” to your application code. The mental model of bearer tokens in HTTP headers is pretty easy. Using mTLS requires understanding a lot more moving parts, and TLS still feels like a magical black box in many ways.

Are there any libraries you would recommend that provide a good developer experience around using mTLS?

[ec109685]

We’ve used Istio for some and a open source system called AthenZ to manage the key material.