2
$\begingroup$

In One-way Transport Layer Security (TLS), client who initiates the connection verifies the identity of the server or entity it is connecting to, but server not necessarily validates client identity.

In Two-way TLS connections, both client and server validates each other's certificate (public key) to achieve mutual authentication. The question here is, does the client necessarily send its certificate? What if the client sends a credentials (E.g token/API key) that the server knows and validates to verify the identity, is this not a mutual authentication and two-way TLS? I do understand certificates are a better way of proving identity than token/secret.

$\endgroup$

1 Answer 1

1
$\begingroup$

Strictly speaking, there is no such specification as "two-way TLS". It is rather an informal expression. It means a TLS connection with mutual authentication based on PKI.

If you use anything else for client authentication, but not TLS/SSL certificates, then it is not a two-way TLS. I'd suggest to use other words, because improper wording leads to misunderstanding and wrong expectations of all people involved: customers, developers, testers, auditors, etc.

To your questions:

does the client necessarily send its certificate?

Yes. Otherwise it is not a "two-way TLS".

What if the client sends a credentials (E.g token/API key) that the server knows and validates to verify the identity, is this not a mutual authentication and two-way TLS?

It is not a "two-way TLS". It does not mean that it is better or worse for particular purpose. It just means we cannot call it "two-way TLS".

$\endgroup$
2
  • $\begingroup$ Are you sure, that my browser sends my/any user certificate when it access https site? I don't agree. $\endgroup$
    – SSA
    Dec 17, 2020 at 8:05
  • $\begingroup$ @SSA: Who said the browser sends user certificate? It is not clear what don't you agree with. May be you have not understood the question. The question is: if the client does not send certificate but uses some other authentication, can it be called a two-way TLS. It is the question about definition. $\endgroup$
    – mentallurg
    Dec 17, 2020 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.