How to organize load balancing between multiple hosts using mTLS? How does mTLS work with a load balancer in its infrastructure?

mTLS (Mutual TLS) provides mutual authentication between the client and server using certificates. When load balancing with mTLS, there are several organizational options:

1. Load balancer as TLS terminator:

   • The load balancer accepts TLS connections from clients, verifies client certificates (mTLS), and then establishes a separate TLS connection with backend servers.
   • In this case, the load balancer acts as the point of mTLS verification, and backend servers can operate without mTLS or with regular TLS.

2. Transparent load balancer (TCP-level):

   • The load balancer simply proxies TCP connections without interfering with TLS.
   • In this case, mTLS is established directly between the client and the backend server, and the load balancer does not see the certificates.

3. Load balancer with certificate passthrough:

   • Some load balancers can pass client certificate information to backend servers via headers or special mechanisms.

When organizing mTLS with a load balancer, it is important to:

• Determine at which level the certificate verification occurs.
• Configure trusted CAs on the load balancer and backend servers.
• Ensure that the load balancer correctly handles or proxies TLS sessions.

For example, in Kubernetes with an ingress controller, you can configure mTLS at the ingress level, and backend servers can accept already verified requests.

Thus, with a load balancer, mTLS can operate either at the load balancer level (TLS termination) or directly between the client and server, depending on the architecture.