Understanding TLS and mTLS Certificates

This is article is primarily to help you understand the difference between TLS and mTLS certificate authentication.

In general, I like to explain this in a very simple way. Imagine you are having a birthday party. Now you invite your friends to the party. In this scenario, the party is the server and the guests are the clients wanting to connect to the server.

The authentication workflow to get guests into the party can be divided into three stages:

Now, let’s apply this to the tech world. Of course, the secret password or key is the RSA-generated private part of your certificate.

For your understanding in general we define a SSL certificate with two parts. The first part is the public (.crt) and the second the private (.key) part.

To show you a SSL certificate in the pem format lets look at the following certificate. PEM-encoded SSL certificate (file server.pem), opened with a text editor:

— — -BEGIN CERTIFICATE — — -
MIIDXTCCAkWgAwIBAgIJALmvlGekTjIcMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV…
 — — -END CERTIFICATE — — -

— — -BEGIN PRIVATE KEY — — — MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCu09kc7eKxqaUP J9bj4XPT+cVX9cqp7xcvB3/SigF/…
— — -END PRIVATE KEY — — -

The above text is the content of the file server.pem and the (BEGIN CERTIFICATE) block represents the public part of the ssl certificate (with the name server.pem) and the (BEGIN PRIVATE KEY) block represents the private key of the certificate.

Now that you understand basic certificates. We can dive into more complex certificates which are sometimes encrypted once. This means to use the certificate we need to provide a passphrase. You can think of this like opening the invitation letter of the party only with a specific knight.