Mutual TLS: What It Actually Proves

Every HTTPS connection you make proves something: that the server is who it claims to be. Almost none of them prove the reverse. The server has no idea who you are until you send it a password, a token, or a cookie — a secret that has to be created, stored, transmitted and rotated, and that anyone who steals it can replay. Mutual TLS moves that proof into the connection itself. Both sides present a certificate, both sides verify the other, and the caller’s identity is established before a single byte of your application protocol is exchanged.