Glossary
Mutual TLS (mTLS)
Ordinary TLS lets a client verify a server's identity and encrypts the traffic between them; it says nothing about who the client is. Mutual TLS adds a certificate on the client side as well, so the server can verify the caller's identity with the same cryptographic strength — a meaningful upgrade for service-to-service traffic, where 'the caller is on our internal network' is not the same thing as 'the caller is who it claims to be.'
Operating mutual TLS well requires the same lifecycle discipline as any other credential: certificates issued to services need rotation, revocation, and a trust root behind them, or the mechanism becomes a strong cryptographic wrapper around a weak certificate-management process.