Significance of mTLS and why you should care about it

Mutual Transport Layer Security (mTLS) is a process that establishes an encrypted TLS connection in which both parties use X.509 digital certificates to authenticate each other.

MTLS can help mitigate the risk of moving services to the cloud and can help prevent malicious third parties from imitating genuine apps.

By default, the TLS protocol only proves the server’s identity to the client using X.509 certificates, and the client authentication to the server is left to the application layer.

TLS protocol also offers client-to-server authentication using client-side X.509 authentication. As it requires provisioning of the certificates to the clients and involves a less user-friendly experience, it’s rarely used in end-user applications.

Mutual TLS authentication is often used in business-to-business (B2B) applications, where a limited number of programmatic and homogeneous clients connect to specific web services, the operational burden is limited, and security requirements are usually much higher as compared to consumer environments.

Advantages:

mTLS protects against a variety of attacks, including:

• Malicious API requests: When it comes to API security, mTLS guarantees that only valid and authenticated users make API requests. It prevents attackers from sending fake API calls to exploit a vulnerability or subverting the expected functionality of the API.
• Credential stuffing: Attackers present themselves as valid users with stolen credentials – likely from a data breach. Credential stuffing attacks that target businesses leveraging mTLS will not be successful without a valid TLS certificate.
• Phishing attacks: Phishing attacks frequently aim to collect user credentials, which are then used to exploit a network or software. Even when a user falls victim to such an attack, the attacker will still need a TLS certificate and a private key to use all the credentials.
• Brute force attacks: A brute force attack is when an attacker, over brute force trial and error, tries to guess a user’s password, which is typically carried out by bots. Because mTLS requires simply more than just a password to gain access to an organization’s network, it helps to render these attacks futile. 
• On-path attacks: On-path attackers insert themselves between the client and the server, intercepting or altering communications. On-path attackers cannot certify with either the client or the server whenever mTLS is utilized, making that attack nearly impossible to execute.
• Spoofing attacks: Attackers can try to “spoof” a web server to a client or the other way around. Spoofing attacks become much more difficult when both parties are required to verify their TLS certificates.

Types of Certificates Involved in mTLS:

As noted earlier, mTLS relies on certificates. A certificate represents each party’s identity. Without it, they have no way of proving they are approved to access the requested resources. The handshake relies on a cryptography standard known as X.509. It is a standard that defines the format of public-key certificates. There are three types of certificates each of which meets this standard.

Root CA Certificate:
The certificate is used to determine which certificate authority signed the client certificate. The server uses it to determine if the client should be trusted. The certificate meets the X.509 standard.

Client and Server Certificate:
Both the client and server use secure certificates that also meet the X.509 standard.

How does mutual authentication work using mTLS?

With mutual authentication, a connection can occur only when the client trusts the server’s digital certificate and the server trusts the client’s certificate. The exchange of certificates is carried out using the TLS protocol.

The client’s digital certificate and private key are kept in a Keystore. If the Keystore contains more than one signed certificate, the certificate with the latest timestamp is used to authenticate the client to the server.

Mutual authentication reduces the risk that a network user inadvertently reveals security information to a malicious or insecure website. Fraudulent email messages may still appear in a user’s inbox.

In practice, mTLS can identify and authorize the following:

• Devices onto a corporate network.
• Users into applications.
• Content delivery network (CDNs) or cloud security services to back-end web servers.
• Business-to-business (B2B) data exchanges that use APIs.
• Internet of Things (IoT) sensors, such as remote traffic cameras.
• microservice architectures in which each microservice must ensure that each component it communicates with is valid and not tampered with.

Connecting Cloud Services and On-Premises Servers:

A perfect use case for mTLS is an e-commerce platform that uses a CDN to help deliver its website to customers around the world.

A visitor to the site performs a standard (one-way authenticated) TLS connection with the CDN, but the CDN performs a mutual (two-way authenticated) connection to the “origin” web server.

The e-commerce website does not want or need to perform cryptographic authentication with any customer. It is important, however, for the CDN and origin server to authenticate each other. This allows both parties to be sure that no interception is occurring that might allow an attacker to deliver malicious content to customers.

References: https://en.wikipedia.org/wiki/Mutual_authentication