Module 8 · mTLS for API-to-API Authentication

Last updated: April 29, 2026

Why this module. “Service A authenticates to service B with an API key in a header” — the dominant pattern, and the source of breaches when keys leak. mTLS replaces shared secrets with cryptographic identity. Operationally harder; cryptographically much stronger.

Why bearer tokens fail

• Tokens leak via logs, errors, screenshots.
• Rotation requires coordination.
• Compromise window is the token lifetime.
• No protocol-level peer verification.

What mTLS adds

• Both client and server authenticate with certificates.
• Identity is cryptographic; can’t be replayed without the private key.
• Certificates rotate frequently (e.g., 24 hours with SPIFFE / Istio).
• Compromise requires stealing the private key, which never travels.

The certificate lifecycle problem

mTLS without good certificate management is brittle:

• Manual issuance → expires → 3am page
• Static CAs → CA breach = catastrophe
• Long-lived certs → revocation problems

Modern certificate platforms

• SPIFFE / SPIRE — workload identity standard; short-lived certs (1h typical), auto-rotated.
• Istio / Linkerd — service mesh handles mTLS automatically (Module 11, Cloud track).
• HashiCorp Vault PKI — flexible; for non-mesh environments.
• cert-manager (Kubernetes) — automates Let’s Encrypt + private CA.

The pragmatic adoption path

1. Identify highest-stakes API-to-API flows (payments, auth, data exfil-relevant).
2. Adopt mTLS there first.
3. Use service mesh if you’re on Kubernetes — almost free.
4. Use Vault + cert-manager if not on Kubernetes.
5. Keep bearer tokens for less-critical or external integrations.

Indian sectoral expectations

• NPCI / UPI — mTLS mandatory for participant systems.
• Open Banking APIs — eIDAS / DCS-aligned mTLS.
• RBI — implicit expectation for high-risk banking integrations.

Defender’s checklist

• mTLS for high-stakes API-to-API flows.
• Cert lifetime ≤ 24 hours where infrastructure supports.
• Automated cert lifecycle (no humans rotating).
• Service mesh if Kubernetes-native.
• Documented identity model — which certs trust which CAs.