Mutual Authentication.

An authentication exchange in which both communicating parties — client and server, or two services — cryptographically prove their identities to each other before exchanging data. It belongs to the Identity & Access category of cybersecurity.

An authentication exchange in which both communicating parties — client and server, or two services — cryptographically prove their identities to each other before exchanging data.

Mutual authentication, sometimes called two-way authentication, requires both sides of a connection to verify the other's identity, not just the server proving itself to the client. The dominant implementation today is mutual TLS (mTLS) defined in RFC 8446 for TLS 1.3, where each side presents an X.509 certificate validated against a private CA. Other examples include Kerberos AP-REQ / AP-REP, SSH host plus key auth, IPsec IKEv2 with certificate authentication, and FIDO2/WebAuthn ceremonies that include attestation. Mutual authentication is mandatory in service-mesh deployments (Istio, Linkerd, Consul) and in zero-trust architectures such as Google BeyondCorp, where every workload-to-workload call is authenticated with short-lived SPIFFE identities. It mitigates impersonation, man-in-the-middle and rogue-service attacks.

Defences for Mutual Authentication typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Two-way authentication, Mutual TLS, mTLS.