MTLS - Mutual TLS (Everything you need to know)

MTLS Part-I:

MTLS Part - II (API Gateway)

Github:

[arunlove]

Best explanation i found, lots of confusion clear loved it. ❤

[BeeThereU]

Thank you. Best explanation I found. Keep up nice work ❤

[AndreLuisPorto]

Thank you, @Sachin, for such great content. It is really helping me a lot!

Now, for any ADHD viewer here, like me, just go get your coffee, take your time and come back to focus: i can assure you that it's not your whatsapp notification poping. Just (try to) ignore it and enjoy the lesson.

[MrBestard]

I just realized many other tutorials have missed/skipped step 6 in the pictures. The step to validate the cert with the CA. Thanks for clearing that up. 🎉

[vitusyu]

Thank you! I am newbie in Java programming and I would like to ask if you have any video on how to setup your development environment, including the maven you used in this video. Thank you again!

[purplemonkeydishwasher]

That article looks great too. Nice plain text recap

[sheksbear]

The explanation and article are beneficial, one feedback is to clearly specify to pass the "public key of " client/server/CA else it may be confusing for people. I first learnt about Asymmetric encryption then came here and it helped.

[codedoctor]

One of best explanation I found so far :), Loved it. Keep up good work

[randomu]

One trap I fell in for modern browsers, they don't really care about CN field anymore, rather they need it to be listed in the SAN (Subject Alternative Name) field

[LolToalNoobs]

One thing I am still confused about. If we use our client public certificate to send to the server and the server simply checks the trust store to make sure it's a trusted client - how does the server know that some other unauthorised/malicious client isn't using our public certificate and pretend to be us? it is a public cert after all

Or are we saying this certificate is not truly public and should be treated like a private key?

OR - do we say that no symmetrical key is generated, and instead both parties use the received public key to encrypt data (ensuring that the recipient can only read if they hold the private key)?)

My idea would be server would encrypt some data using the public key, send to client and client must send back correct result to verify client holds the private key, THEN and only THEN can a symmetric key be used - but this is not explained anywhere. Please help (::

[ЕвгенийВовчок-ыр]

Thanks for the video. This part with the graphic was very useful for understanding

[Letraveler_rd]

Can you explain how to generate a cliente certificate? I’m not sure what to place on the CN field since it’s a server. I would like to talk more in detail to you.

[memosen]

Thank you but it would make more sense if you showed 2 different apps client and server and adjust the application.yml accordingly.

[ManishKumar-rzub]

10:59 why are we importing trust stores in Keystore?

[MonojitBarua]

@06:50 can you explain what is the -cacert you are passing in curl command, is that the client ca cert? if so why we are sending client ca cert to server?

[pradiptakar]

Hi Sachin, I am trying to implement mTLS in tomcat. But it's not validating the leaf certificate. Just presence of root and intermediary seems enough. Can you please help how to ensure leaf level certificate validation

[marcopierrefernandezburgos]

My application is running in AWS ECS, the path to connect to my app externally is as follows:

AWS route53 => Load Balancer => AWS ECS (my app runs here)

Do you know if I could still perform mTLS in my app running in ECS? I think that the only way would be to introduce an AWS API Gateway. What do you think?

By the way, I love this video, it is the best for this topic.

[himuhotbaba]

Hi, Which tool you are using to executr this MTLS?

[zeyuanzhang]

i mean is it same when i integrate several certificatesfiel which are included in cert chain into one cert file as ca.crt, then i used the client.crt which is not changed and integrated atalld to auth?i just failed in traefik environment.

[zeyuanzhang]

but when i set up mtls in traefik, the cert returns the server.crt, but my leader told me cert chain containing several cert files including server.crt and ca.crt is normal but not single cert as server.crt