MTLS

Full Title or Meme

Mutual Transport Layer Secure redirects to Mutual Authentication.

Solutions

Google Cloud just announced Public Preview of backend authenticated TLS and backend mutual TLS (mTLS) for Global External Cloud Load Balancer. This is a second phase of the full end-to-end mutual TLS architecture where fist phase was covering frontend mTLS announced last year.

What is backend authenticated and backend mutual TLS (mTLS)?

In typical HTTPS communication, neither the load balancer nor the backend verify each other's identity, assuming that they are within a secure perimeter and can be trusted. However, when perimeter security needs reinforcement or communication extends beyond the perimeter, backend mTLS becomes essential. This ensures secure communication by requiring both the load balancer and the backend to mutually verify their identities. With backend authenticated TLS, the load balancer verifies the backend server’s certificate by checking its chain of trust, thereby confirming the backend’s identity. Conversely, the backend server verifies the client certificate presented by the load balancer. Together, these mechanisms enable backend mTLS, ensuring that both parties validate each other's identity.

Backend authenticated TLS and backend mTLS overview