Securing Microservice-to-Microservice Communication

In this lesson, you will learn how to verify the identity of internal services within your cluster using Mutual TLS (mTLS).

Why Standard TLS Isn't Enough

When Service A calls Service B, standard TLS ensures the connection is encrypted and that Service A knows it’s talking to the real Service B. However, Service B has no idea who is calling it. In a microservices architecture, you need to ensure that only authorized internal services can talk to one another, preventing rogue services or attackers from spoofing requests.

The Power of Mutual TLS (mTLS)

With mTLS, the handshake is inverted: both the client and the server present certificates to each other.

1. The server asks for the client's certificate.
2. The client provides a certificate signed by a trusted Internal Certificate Authority (CA).
3. The server validates that certificate against its local CA root.

If the certificate isn't signed by your trusted internal authority, the handshake fails immediately at the transport layer, well before the request reaches your application logic.

Implementation in Node.js

In Node.js, you configure this via the https module. Instead of just providing a key and cert for the server, you add the ca and requestCert options:

const https = require('https');
const fs = require('fs');

const options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem'),
  ca: fs.readFileSync('internal-ca.pem'), // Trusted CA
  requestCert: true,                     // Request client cert
  rejectUnauthorized: true              // Reject if not signed by CA
};

https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('Hello, verified peer!');
}).listen(443);

By setting rejectUnauthorized: true, your Node.js service effectively acts as a gatekeeper. Any service attempting to communicate without a valid certificate issued by your internal CA will be blocked at the connection level. This is far more secure than relying solely on API keys or shared secrets, which can be leaked or intercepted in logs.

Key Takeaway: Mutual TLS shifts authentication from the application layer to the transport layer, ensuring that only services possessing a valid, CA-signed certificate can successfully open a connection to your API.