In our system, mTLS (mutual TLS) is used to secure communication with the public API. mTLS provides an additional layer of security by requiring mutual authentication on both the client and server sides. This ensures that both parties are confident in their counterparts' identities, which protects against unauthorized access and man-in-the-middle (MitM) attacks.
1.
Connection initialization: The Client initiates a connection to the API server. Both parties agree on encryption parameters and session keys are generated.
The API server sends its certificate to the Client for authentication.
The Client verifies the server certificate against its set of trusted CA certificates.
The Client sends its certificate to the API server.
The API server verifies the Client certificate using its own set of trusted CA certificates.
3.
Establishing a secure connection: After mutual verification of certificates, the connection is encrypted and deemed secure. From this point on, both parties can exchange data confidentially and integrally.