Service Mesh Identity: Securing mTLS Traffic 2026

Executive summary — North-south traffic has been secured for years; the east-west traffic between microservices often has not. A service mesh closes that gap by giving every service an identity and encrypting every internal call with mutual TLS. This article explains mesh identity models, automatic mTLS, certificate rotation, and integration with an internal CA, building on service mesh identity.

In a microservices architecture, the volume of internal service-to-service traffic, east-west traffic, dwarfs the external traffic entering the system. Yet for years security focused almost entirely on the perimeter, leaving internal calls unauthenticated and unencrypted on the assumption that the internal network was safe. That assumption collapsed with cloud, containers, and Zero Trust thinking. A service mesh is the architectural response: it makes identity and encryption a property of the platform, applied uniformly to every internal call without changing application code.

Identity as the Foundation of the Mesh

The mesh cannot secure traffic until it can name the things talking to each other. Every service in the mesh is issued a cryptographic identity, typically a short-lived certificate carrying a SPIFFE-style identifier, so that each workload can prove who it is to every other workload. This is the same identity layer described in workload identity in Kubernetes, now applied to authorise communication rather than just to exist. Without this per-service identity, mutual authentication is impossible and the mesh degrades into simple encryption without trust.

Automatic Mutual TLS

The mesh signature feature is automatic mutual TLS. Each service runs alongside a sidecar proxy that intercepts its inbound and outbound traffic. When two services communicate, their proxies perform a mutual TLS handshake, each presenting its certificate and verifying the other, and then encrypt the connection. The application code is unaware any of this happened; it makes an ordinary call and the mesh transparently authenticates and encrypts it. This is how an organisation can secure thousands of internal connections uniformly without asking every development team to implement TLS correctly.

Securing east-west traffic across your mesh? eMudhra machine identity provides governed workload identity and certificate issuance that integrates with your service mesh and internal CA.

Certificate Rotation at Machine Speed

Mesh identities are deliberately short-lived, often valid for hours, which sharply limits the damage a stolen credential can do. The trade-off is volume: certificates must be issued and rotated constantly, at a scale no manual process could sustain. The mesh automates this, requesting fresh certificates and rotating them transparently before expiry. That relentless churn is only safe when it is backed by automated certificate lifecycle management, tying mesh security directly to certificate lifecycle management and to the automation principles of automated certificate renewal with ACME.

Integrating With an Internal CA

A common early mistake is to let the mesh run its own self-contained certificate authority disconnected from enterprise PKI. That creates an ungoverned island of trust, invisible to security teams and inconsistent with the rest of the estate. The stronger pattern integrates the mesh with the organisation internal CA, so mesh certificates are issued under the same policy, naming, and audit regime as every other certificate. This keeps the mesh inside the governed perimeter and makes its identities part of the enterprise trust fabric rather than an exception to it, a core concern of machine identity management.

The Bigger Picture

Service mesh identity is where Zero Trust becomes concrete for internal traffic: every call authenticated, every connection encrypted, every workload identified, and every certificate governed and rotated. It is the internal counterpart to the perimeter controls organisations already run, and it completes the identity story that begins with workloads and extends across clusters and clouds. Teams operationalising this at enterprise scale should compare approaches through a machine identity platform comparison, prioritising internal-CA integration, rotation automation, and governance over raw feature counts.

SECURE EAST-WEST TRAFFIC WITH GOVERNED IDENTITY
eMudhra brings governed workload identity and certificate lifecycle to your service mesh. Explore eMudhra machine identity or contact the eMudhra team.