0Pricing
gRPC & High Performance APIs · 课时

用于服务间身份验证的双向 TLS（mTLS）

使用双向 TLS 保护 gRPC 服务间调用：客户端和服务器都出示证书，以通过密码学方式证明身份。

用于服务间身份验证的双向 TLS（mTLS） 是 CoddyKit 上的免费 gRPC & High Performance APIs 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 gRPC & High Performance APIs 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 gRPC & High Performance APIs 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Beyond One-Way TLS

Standard TLS authenticates only the server to the client. In a zero-trust network, the server also needs to verify who is calling.

Mutual TLS (mTLS) makes both sides present certificates.

How mTLS Works

During the handshake:

  • The server sends its certificate (as in normal TLS)
  • The server then requests the client's certificate
  • The client presents its cert and proves it holds the private key
  • Each side validates the other against a trusted CA

The Role of the CA

A Certificate Authority (CA) signs both client and server certs. Each peer trusts the CA, so any cert signed by it is accepted. In service meshes an internal CA issues short-lived certs automatically.

Generating Certificates

For a test setup you create a CA, then sign a server cert and a client cert with it. Tools like openssl or cfssl produce the key/cert pairs.

openssl req -x509 -newkey rsa:4096 -keyout ca.key -out ca.crt -days 365 -nodes

Server Side in Go

Configure the server's tls.Config to load its cert and require client certs verified against the CA pool.

cfg := &tls.Config{
  Certificates: []tls.Certificate{serverCert},
  ClientCAs:    caPool,
  ClientAuth:   tls.RequireAndVerifyClientCert,
}
creds := credentials.NewTLS(cfg)

Wiring the Server

Pass the TLS credentials when constructing the gRPC server so every connection is mutually authenticated.

s := grpc.NewServer(grpc.Creds(creds))

Client Side in Go

The client presents its own certificate and trusts the CA to validate the server.

cfg := &tls.Config{
  Certificates: []tls.Certificate{clientCert},
  RootCAs:      caPool,
}
conn, _ := grpc.Dial(addr, grpc.WithTransportCredentials(credentials.NewTLS(cfg)))

Reading the Peer Identity

Once connected, the server can read the client's certificate from the connection's peer info and use the subject or SAN as an authenticated identity.

p, _ := peer.FromContext(ctx)
tlsInfo := p.AuthInfo.(credentials.TLSInfo)
name := tlsInfo.State.PeerCertificates[0].Subject.CommonName

Certificate Rotation

Certs expire. Production systems rotate them frequently using short lifetimes (hours/days). A sidecar or mesh control plane reloads new certs without restarting the service.

mTLS in Service Meshes

Meshes like Istio or Linkerd automate mTLS entirely: sidecar proxies handle the handshake, issue certs, and rotate them, so application code stays unchanged.

Common Pitfalls

Watch out for:

  • Clock skew breaking cert validity checks
  • Wrong CA pool causing handshake failures
  • Mismatched SAN/hostname errors
  • Forgetting RequireAndVerifyClientCert (downgrades to one-way TLS)

Quick Check

Test your mTLS understanding.

Recap

You learned mutual TLS for gRPC:

  • mTLS authenticates both client and server
  • A shared CA signs and validates certificates
  • Set RequireAndVerifyClientCert on the server, present a client cert on the dial
  • Read peer identity from the verified certificate
  • Rotate certs often; meshes automate the whole flow

常见问题解答

「用于服务间身份验证的双向 TLS（mTLS）」课时是免费的吗？

是的 — 「用于服务间身份验证的双向 TLS（mTLS）」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 gRPC & High Performance APIs 课程的其余内容，请升级到 CoddyKit PRO。 gRPC & High Performance APIs 课程共包含 4 节课。

「用于服务间身份验证的双向 TLS（mTLS）」这节课中我会学到什么？

使用双向 TLS 保护 gRPC 服务间调用：客户端和服务器都出示证书，以通过密码学方式证明身份。 你通过在浏览器中直接运行的动手代码来练习 gRPC & High Performance APIs，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 gRPC & High Performance APIs 需要有经验吗？

无需任何先前经验。CoddyKit 上的 gRPC & High Performance APIs 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。

「用于服务间身份验证的双向 TLS（mTLS）」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 gRPC & High Performance APIs 课中编写并运行代码吗？

能。每节 gRPC & High Performance APIs 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. gRPC 的 TLS/SSL
  2. 身份验证与授权
  3. 用于安全防护的拦截器
  4. 用于服务间身份验证的双向 TLS（mTLS）
← 返回 gRPC & High Performance APIs