Millipede Academy

Book 3 · Lesson 3.3

mTLS service-to-service

  • Contrast TLS (server auth) with mTLS (both sides)
  • Walk gateway → ingestion/analyzer rustls hops
  • Enable MILLIPEDE_MTLS=1 in dev

Prerequisites: 3.2 · 0.8

Browser-to-gateway uses TLS + JWT. Gateway-to-backend uses mTLS — client certificate proves gateway identity.

1
ClientHelloGateway proposes TLS 1.3 + cipher suites
2
ServerHello + certGateway presents dev cert (infra/certs/dev/gateway.crt)
3
Client verifies chainTrust local CA or skip verify in dev (-k)
4
Client cert (mTLS)Optional: gateway requires client.pem for backend hop
5
FinishedEncrypted tunnel — JWT + HTTP inside TLS to :8443
6
mTLS to backendGateway opens rustls client to ingestion/analyzer :8083/:8084

Port map (mTLS mode)

ServicePlainmTLS
ingestion:8081:8083
analyzer:8082:8084
gateway:8443HTTPS + client cert to backends

Gateway build_http_client() loads gateway.pem + ca.pem from infra/certs/dev/.

Teach-back prompt

What fails if ingestion trusts any client cert without checking the CA?

mTLS curl to gateway

Lesson 3.3 check

1. mTLS requires…