After webhooks (19 Nov), this post covers mutual TLS: workload identities, rotation, authz after authn, fail-closed verify, mesh versus library termination, clock skew, handshake metrics and break-glass paths versus browser headers and key management.

पारस्परिकTLSधर्मः: A Metrical Codification of Mutual TLS (with English glosses)

What this post is about

Mutual TLS authenticates both sides of a connection with certificates so service identity is proven not assumed from network location.

Topics covered

1. Beyond private-IP trust
2. Workload identity issuance
3. Short-lived rotation
4. Authorize after authenticate
5. Fail-closed verify
6. Mesh vs app terminate
7. Clock skew hygiene
8. Handshake error metrics
9. Break-glass access
10. Headers vs mTLS vs key life

Sanskrit title

पारस्परिकTLSधर्मः = pārasparika-TLS-dharmaḥ “dharma of mutual TLS”.

English

Minimizable; Sanskrit-first.

ग्राह्यम् / Keep

१. workload identities: auto rotate
२. deny expired peers: hard
३. authz by identity+method: not any-cert god
४. fail closed verify: prod default
५. one terminate layer clear: mesh or app
६. NTP hygiene: avoid skew flaps
७. handshake metrics by reason: fast RCA

त्याज्यम् / Avoid

• trust flat network without peer certs
• optional mTLS forever in prod
• accept expired certs to stop pages

पदच्छेदः
सेवासेवासंवादे यदि केवलं जालं विश्वस्तं तदा मिथ्या । पारस्परिकTLSधर्मस्तस्माद् उभयचिनह्नम् ॥१॥

Word-for-word

Gloss table

English sense
Mutual TLS makes both client and server present certificates so identity is cryptographic not just a private IP myth.

Context / topic
Topic: why mTLS. Distinct from edge TLS to browsers only.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
SPIFFE/SPIRE or mesh identities । long-lived shared cert copy युद्धाय ॥२॥

Word-for-word

Gloss table

English sense
Prefer automatically rotated workload identities over hand-copied PEM files on disk forever.

Context / topic
Topic: identity issue.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
rotate often; deny expired hard । ignore expiry theater ॥३॥

Word-for-word

Gloss table

English sense
Short lifetimes force rotation paths to work. Accepting expired peer certs undoes mTLS value.

Context / topic
Topic: rotation.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
authorize after authenticate । any valid cert == god मा ॥४॥

Word-for-word

Gloss table

English sense
Map identities to allowlists of methods and resources. A valid company cert is not blanket permission.

Context / topic
Topic: authz.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
fail closed on verify errors रक्ष । optional mTLS mode द्वारम् ॥५॥

Word-for-word

Gloss table

English sense
Production should fail closed when peer verify fails. Optional modes are migration bridges not forever homes.

Context / topic
Topic: fail posture.

वृत्तमिति: एकादशाक्षराः पादाः।

पदच्छेदः
mesh sidecar or library both valid । double terminate confuse ॥६॥

Word-for-word

Gloss table

English sense
Pick mesh-terminated or app-terminated mTLS deliberately. Doing both without a map confuses identity and metrics.

Context / topic
Topic: terminate place.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
clock skew breaks verify । NTP hygiene अवश्यम् ॥७॥

Word-for-word

Gloss table

English sense
Keep node time sane. Skew creates flapping trust failures that look like outages.

Context / topic
Topic: time.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
observability: handshake fails by peer । generic 5xx अन्धता ॥८॥

Word-for-word

Gloss table

English sense
Count TLS handshake errors by reason and peer identity. Generic application 5xx hides PKI pain.

Context / topic
Topic: metrics.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
break-glass human path documented । only mTLS no escape stuck ॥९॥

Word-for-word

Gloss table

English sense
Document emergency access when identity systems fail. Pure lockout without a drill is self-DoS.

Context / topic
Topic: break-glass.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
सुरक्षाशीर्षाणि browser perimeter mTLS service identity । कुञ्जीप्रबन्धः cert life ॥१०॥

Word-for-word

Gloss table

English sense
Security headers shape browsers; mTLS shapes service-to-service identity; key management owns cert and secret life cycles.

Context / topic
Topic: series distinctions.

सन्धिः: शीर्ष भोक्तृपरिधि; mTLS सेवाचिनह्न; कुञ्जी आयुः।

वृत्तमिति: एकादशाक्षराः पादाः।

पदच्छेदः
identity rotate authz fail-closed observe पञ्चकम् । एभिः पारस्परिकTLSधर्म उभयचिनह्नसमन्वितः ॥११॥

Word-for-word

Gloss table

English sense
Five limbs: workload identities, frequent rotation, method authz after authn, fail-closed verify and handshake observability.

Context / topic
Topic: checklist.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
इति पारस्परिकTLSधर्मसार उभयचिनह्नसमन्वितः । मितं उभयप्रमाणं क्रियायोग्यं तन्त्रधर्मः स उच्यते ॥१२॥

Word-for-word

Gloss table

English sense
Closing: both sides prove who they are, permissions still apply and expired trust is no trust.

Context / topic
Topic: close.

उपसंहारन्यायः: उभौ प्रमाणय; अनुमतिं देहि; कालं सत्यं कुरु।

वृत्तमिति: ८-८-८-८।

१. Why mTLS
२. Identity
३. Rotate
४. Authz
५. Fail-closed
६. Terminate
७. Time
८. Metrics
९. Break-glass
१०. Series
११. Five limbs
१२. Close

1. Prior: webhooks 2026-11-19; security headers 2026-10-31; keys 2026-10-19; authz 2026-10-08.
2. Domain: mutual TLS.
3. English minimizable; Sanskrit-first.
4. Style: no em dash; no Oxford comma in English clauses.