I suspect mTLS adoption has been slow because it’s easier to reason about authentication when the mechanics are “closer” to your application code. The mental model of bearer tokens in HTTP headers is pretty easy. Using mTLS requires understanding a lot more moving parts, and TLS still feels like a magical black box in many ways.
Are there any libraries you would recommend that provide a good developer experience around using mTLS?
Comments
The same thing occurred to me while reading this.
I suspect mTLS adoption has been slow because it’s easier to reason about authentication when the mechanics are “closer” to your application code. The mental model of bearer tokens in HTTP headers is pretty easy. Using mTLS requires understanding a lot more moving parts, and TLS still feels like a magical black box in many ways.
Are there any libraries you would recommend that provide a good developer experience around using mTLS?
We’ve used Istio for some and a open source system called AthenZ to manage the key material.