mTLS authenticates clients with certificates. Design enrollment, private-key protection and revocation together.
Evaluation approach
Choose an appropriate identity per device or registration. A shared private key across all copies weakens device-specific trust.
Application example
When an employee leaves, revoke device certificates and account authority together.
Limits and considerations
Presenting a certificate does not grant access to every API object.
Enrollment risk matters
If certificates can be issued for unauthorized identities, strong transport authentication reinforces the wrong account. Include enrollment, renewal and revocation in one assessment.
Checks and decisions
- Generate separate keys
- Test revocation
- Limit authority
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.