Book 3 capstone — mTLS between services

You finished Book 3 — Security & Privacy. Prove the full security shell.

Rubric (self-grade)

Criterion	Pass?
Zero-trust layers named
JWT mint + curl with Bearer
mTLS certs generated and verified
WASM redaction on 1:1 portal
Slack signature concept
Manager scope enforced

playstepchallengeinstructor

Edge (gateway)JWT · TLS · rate limitsService mesh (mTLS)Client cert · CA trust · no plaintext hopData planeLeast privilege DB · encrypted fieldsBrowser (radar)WASM redact before submit · no secrets in bundle

Principle: never trust, always verify — even inside compose.

playstepchallengeinstructor

Walk handshakePause

1

ClientHelloGateway proposes TLS 1.3 + cipher suites

2

ServerHello + certGateway presents dev cert (infra/certs/dev/gateway.crt)

3

Client verifies chainTrust local CA or skip verify in dev (-k)

4

Client cert (mTLS)Optional: gateway requires client.pem for backend hop

5

FinishedEncrypted tunnel — JWT + HTTP inside TLS to :8443

6

mTLS to backendGateway opens rustls client to ingestion/analyzer :8083/:8084

Book 3 → Book 4 bridge

Book 4 builds the pipeline skeleton — you now understand why gateway and certs exist.

Teach-back prompt

Draw browser → gateway → ingestion on one diagram with JWT and mTLS labels.