Network & Infrastructure / Segmentation, TLS & Secure Connectivity
mTLS identity is not the same as application authorization
Two workloads successfully authenticate each other with certificates, yet one receives access beyond its intended role. A valid certificate proves an identity under a trust model, not every permission.
Environment and inputs: Stateful network boundaries, TLS endpoints and IPsec gateways; use the deployed security policy and implementation manual. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Inspect peer certificate identity, issuing trust domain, application authorization mapping and request-level decisions. Separate handshake success from whether the identified caller is permitted to perform the operation.
Explain the result
Mutual TLS can authenticate both endpoints while leaving authorization to another layer. Trusting a broad issuer without constraining workload identity can admit unintended callers.
Plan the fix
Map specific authenticated identities to reviewed roles and enforce least-required operations. Plan certificate rotation and identity continuity without using a blanket issuer-based administrative role.
Check the result and rollback
Test authorized and unauthorized workload identities against sensitive operations. Revert if the mapping denies essential service dependencies, then correct the role scope without disabling peer authentication.