Mutual TLS (mTLS)
TLS where both sides present a certificate. The server is not the only one who has to prove who they are.
Ordinary TLS authenticates the server to the client. The browser checks a certificate; the site does not check yours. Mutual TLS, mTLS, is the same handshake with client authentication turned on. NIST SP 800-52 Rev. 2 is blunt: client authentication is optional in TLS and happens only if the server asks. When it does, the client presents an X.509 certificate and proves it holds the private key.
That is why service-to-service traffic uses it. Two workloads, each with a certificate, each verifying the other, before any application data moves. A stolen bearer token pasted into curl does not get you in if you cannot present the client cert. It is identity on the transport, not authorisation. Who you are is not what you are allowed to do. Pair it with an authorisation check in the app or a policy engine.
The hard part is the certificates: issuance, rotation, revocation, and not sharing one client cert across every pod. A mesh can run this for you. A shared PFX in a wiki cannot. Expired client certs fail closed, which is correct and will page you.
Fact source: NIST SP 800-52 Rev. 2, TLS guidelines.