Question 957

Both Sides Show Papers

Your mesh enables mutual TLS for all service-to-service traffic, with certificates issued to each workload. Security asks what this buys you over ordinary TLS. What is the accurate answer?

A

The caller can be trusted to declare its own identity in a header, since the encrypted channel prevents any intermediary from forging or rewriting that header

B

The callee also verifies the caller's certificate, so it obtains a cryptographically proven workload identity it can write authorization policy against

C

Traffic becomes encrypted in both directions, whereas ordinary TLS encrypts only the responses flowing back from the server to the client

D

The callee learns which end user initiated the request from the peer certificate, so per-user permission checks can move out of the application and into mesh policy