Mastering Service Mesh

Enabling an Ingress gateway for httpbin using mutual TLS

In SIMPLE TLS, the client checks the identity of the server, but in mutual TLS, the server also checks the identity of the client. The mutual TLS adds another layer in which the client sends its X.509 certificate to a server to verify the identity of the client.

Mutual TLS is useful for business-to-business applications that require strict access control. Let's get started:

1. Create a client certificate and key using RSA that will be used by the client (curl, in this case) to provide client authentication to the Istio Ingress gateway:

$ step certificate create httpbin.istio.io client.crt client.key --profile leaf --ca istio.crt --ca-key istio.key --no-password --insecure --kty RSA ...