| name | implementing-mtls-for-zero-trust-services |
| description | Configures mutual TLS (mTLS) authentication between microservices using Python cryptography library for certificate generation and ssl module for TLS verification. Validates certificate chains, checks expiration, and audits mTLS deployment status. Use when implementing zero-trust service-to-service authentication.
|
| domain | cybersecurity |
| subdomain | security-operations |
| tags | ["implementing","mtls","for","zero"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"] |
Implementing mTLS for Zero Trust Services
When to Use
- When deploying or configuring implementing mtls for zero trust services capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Common Misconfigurations & Verification
- Server accepts any client cert (no CERT_REQUIRED): with
verify_mode = CERT_NONE/CERT_OPTIONAL the handshake completes even with no client cert — that is TLS, not mTLS. Set context.verify_mode = ssl.CERT_REQUIRED and load_verify_locations(ca.pem). Confirm rejection: openssl s_client -connect svc:8443 with no -cert must fail with peer did not return a certificate.
- Chain validated but identity not checked: verifying the cert is CA-signed is not enough — any service holding a CA-issued cert can connect. Enforce the expected SAN/CN per peer (
context.check_hostname or an explicit SAN allowlist) so service A cannot present service B's valid cert.
- Expired/near-expiry certs fail at runtime: short-lived service certs that aren't rotated cause hard outages. Audit
not_valid_after and alert before expiry; check with openssl x509 -enddate -noout -in svc.pem.
- Revocation ignored: without CRL/OCSP a compromised-but-unexpired cert stays trusted. Confirm revoked certs are actually rejected, not just issued.
- Confirm both directions: test a valid client (success), a no-cert client (rejected), and a cert signed by a different CA —
openssl s_client -cert wrong.pem must fail with unknown ca. Don't conclude mTLS works from one happy-path call.
Prerequisites
- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
Generate CA certificates, issue service certificates, and configure mutual TLS
verification for service-to-service authentication.
from cryptography import x509
cryptography.x509.oid NameOID
cryptography.hazmat.primitives hashes, serialization
cryptography.hazmat.primitives.asymmetric rsa
datetime
ca_key = rsa.generate_private_key(public_exponent=, key_size=)
ca_cert = (x509.CertificateBuilder()
.subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, )]))
.issuer_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, )]))
.public_key(ca_key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(datetime.datetime.utcnow())
.not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=))
.add_extension(x509.BasicConstraints(ca=, path_length=), critical=)
.sign(ca_key, hashes.SHA256()))
