Service identity & mTLS

Ordinary TLS (P53) proves the server's identity to the client. Between services that is only half of what you need: the server must also know which workload is calling. With one-sided authentication, any client that can reach the service — a compromised pod, a stray script — is accepted at the transport layer.

mTLS closes it: both sides present a certificate, both validate the other's, and only then is a session established. This module builds that state machine, deriving the session key with HMAC (ties P52) once — and only once — both sides have proven themselves.