What is mTLS
mTLS (mutual TLS) — a TLS mode where not only the server but also the client presents a certificate. The server verifies the client cert against a trusted CA list → decides access. Use cases: service-to-service in microservices, API Gateway with client certs, banking and gov services, Zero Trust architectures. More complex than regular HTTPS — you need CA infrastructure + rotation.
Below: details, example, related terms, FAQ.
Details
- Server config:
ssl_verify_client on;+ssl_client_certificate ca.pem; - Client config: curl
--cert client.pem --key client.key - Certificate chain: client cert must be signed by a trusted CA
- TLS 1.3: uses CertificateRequest in handshake, not renegotiation
- Revocation: OCSP or CRL for revoked client certs
Example
nginx:
ssl_verify_client on;
ssl_client_certificate /etc/ssl/ca.pem;
# $ssl_client_s_dn contains client cert subjectRelated Terms
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
How-to
Frequently Asked Questions
mTLS vs API key?
mTLS — cryptographic proof of private-key ownership. API key — a string vulnerable to leaks. mTLS is safer but harder to rotate.
How to distribute client certs?
Automated issuance via an internal CA (Vault, Smallstep), rotate every 30-90 days. For external partners — manual process.
Does it work in browsers?
Yes. Browser shows a cert-picker UI from the OS store. Chrome + macOS — TouchID unlock.