High ThreatCryptography & ProtocolsCWE-295
Mutual TLS (mTLS) Implementation for Microservices
Implement Mutual TLS (mTLS) for microservices to enforce Zero Trust architecture and automate certificate rotation.
Vulnerability Overview
Without client certs, anyone on the network can call internal APIs.
Internal network pivot allows accessing unprotected microservices.
Vulnerable Code
tls: mode: DISABLETraffic is unencrypted and unauthenticated.
Remediated Code
tls: mode: STRICTRequires mTLS for all traffic.
Hardening Rules
- 1Enforce strict mTLS
- 2Automate cert rotation (SPIFFE/SPIRE)
- 3Validate SANs
Frequently Asked Questions
What is SPIFFE?
A standard for securely authenticating software services in dynamic environments.