Web security primitives — TLS and mTLS

TLS encrypts traffic and proves server identity. mTLS adds client certificates so backends only talk to known peers.

Team Radar Stage 2 uses both:

• Browser/gateway: HTTPS + JWT
• Gateway → ingestion/analyzer: mTLS on :8083 / :8084

playstepchallengeinstructor

Walk handshakePause

1

ClientHelloGateway proposes TLS 1.3 + cipher suites

2

ServerHello + certGateway presents dev cert (infra/certs/dev/gateway.crt)

3

Client verifies chainTrust local CA or skip verify in dev (-k)

4

Client cert (mTLS)Optional: gateway requires client.pem for backend hop

5

FinishedEncrypted tunnel — JWT + HTTP inside TLS to :8443

6

mTLS to backendGateway opens rustls client to ingestion/analyzer :8083/:8084

Dev cert bootstrap

bash infra/certs/generate-dev-certs.sh
MILLIPEDE_MTLS=1 pnpm gateway:dev

Read a cert:

openssl x509 -in infra/certs/dev/gateway.crt -text -noout | head -25

Full runbook: docs/stage2-gateway.md.

Teach-back prompt

Where is JWT checked vs where is the client certificate checked?