Zero Trust Microservices: Implementing mTLS, Cryptographic Identity & Ephemeral Tokens

For decades, enterprise security relied on the assumption that anything inside the private corporate network or VPC could be trusted. A single compromised workstation, misconfigured VPN profile, or unpatched dependency was all an adversary needed to pivot laterally across the entire database fleet.

Zero Trust operates under a simple, uncompromising doctrine: "Never trust, always verify." Every service call, whether crossing the public internet or traveling between two containers on the same physical host, must prove its cryptographic identity and authorized permissions before executing.

In a standard TLS handshake, only the server proves its identity with a certificate. In mTLS, the client must also present a valid X.509 certificate signed by the internal private Certificate Authority (CA). Below is an Envoy proxy mTLS filter configuration:

static_resources:
  listeners:
  - name: internal_mtls_ingress
    address:
      socket_address: { address: 0.0.0.0, port_value: 8443 }
    filter_chains:
    - transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
          common_tls_context:
            tls_certificates:
            - certificate_chain: { filename: "/etc/certs/service-cert.pem" }
              private_key: { filename: "/etc/certs/service-key.pem" }
            validation_context:
              trusted_ca: { filename: "/etc/certs/internal-ca.pem" }
              require_client_certificate: true
              match_typed_subject_alt_names:
              - san_type: URI
                matcher:
                  exact: "spiffe://natelad.internal/ns/production/sa/payment-service"

Static API keys and long-lived JWTs stored in environment variables are high-value targets for threat actors. Natelad architectures enforce ephemeral tokens with a maximum lifespan of 15 minutes, issued via OIDC federated identity providers and automatically refreshed in-memory.