What is Mutual TLS (mTLS)?
A security protocol where both client and server verify each other's identity using certificates.
Definition
Mutual TLS (mTLS) extends standard TLS by requiring both the client and server to present and verify X.509 certificates during the handshake. In standard HTTPS, only the server proves its identity to the client. With mTLS, the client also proves its identity to the server using a client certificate. This provides strong authentication for service-to-service communication without relying on API keys or tokens that could be stolen.
Simple Analogy
Like two people exchanging ID cards before a conversation — both parties verify the other is who they claim to be, not just one side. It is mutual verification.
Why It Matters
mTLS provides the strongest authentication for cron job endpoints. API keys can be stolen, tokens can be intercepted, but client certificates are extremely difficult to forge. For high-security environments — financial services, healthcare, government — mTLS ensures that only authorized schedulers can trigger your cron job endpoints.
How to Verify
Check your web server configuration for client certificate requirements. In Nginx, look for "ssl_client_certificate" and "ssl_verify_client on" directives. Test with curl: "curl --cert client.crt --key client.key https://your-endpoint.com". If the endpoint rejects requests without a client certificate, mTLS is enforced.
Common Mistakes
Not managing certificate expiration — expired client certificates cause sudden authentication failures. Making mTLS mandatory without a fallback authentication method for debugging. Not distributing certificates securely. Using self-signed certificates without proper CA chain validation.
Best Practices
Use a proper certificate authority (even an internal one) for mTLS certificates. Automate certificate rotation before expiration. Monitor certificate expiry dates with scheduled cron jobs. Maintain a fallback authentication method for emergency access. Document the certificate provisioning process for new services and team members.
Security Documentation
Read security docs
Try it free →Frequently Asked Questions
What is Mutual TLS (mTLS)?
Mutual TLS (mTLS) extends standard TLS by requiring both the client and server to present and verify X.509 certificates during the handshake. In standard HTTPS, only the server proves its identity to the client. With mTLS, the client also proves its identity to the server using a client certificate. This provides strong authentication for service-to-service communication without relying on API keys or tokens that could be stolen.
Why does Mutual TLS (mTLS) matter for cron jobs?
mTLS provides the strongest authentication for cron job endpoints. API keys can be stolen, tokens can be intercepted, but client certificates are extremely difficult to forge. For high-security environments — financial services, healthcare, government — mTLS ensures that only authorized schedulers can trigger your cron job endpoints.
What are best practices for Mutual TLS (mTLS)?
Use a proper certificate authority (even an internal one) for mTLS certificates. Automate certificate rotation before expiration. Monitor certificate expiry dates with scheduled cron jobs. Maintain a fallback authentication method for emergency access. Document the certificate provisioning process for new services and team members.
Related Terms
SSL/TLS
Encryption protocols that secure HTTP connections, ensuring data privacy and integrity.
HTTPS
The secure version of HTTP that encrypts all communication between client and server.
Authentication
Verifying the identity of a user or system making a request to your endpoint.
Certificate Pinning
Hardcoding an expected SSL certificate to prevent man-in-the-middle attacks with forged certificates.
Zero Trust
A security model that verifies every request regardless of its origin, trusting nothing by default.