What Is ‘2 Way SSL’ and How Does It Work?

There’s a thing called two way SSL/TLS — here’s what you need to know about it

“Wait, what? 2 way SSL/TLS?”

If this was your reaction when hearing or reading about 2 way SSL (or two way SSL, if you prefer), then we totally understand your confusion. SSL, by any means, isn’t easy to understand on its own. And when you get to know a different version of it than you’re used to — mutual authentication instead of the standard one way authentication — the facepalm reaction is totally natural. But don’t you worry — we’re going to break down what two way SSL is and how it work to further continue our quest to simplify every complex SSL-related topic for the “netizens” of the world.

Two way SSL is an SSL/TLS certificate where the client and server verify each other to communicate with each other securely.

Before we jump right into the topic of two way SSL, let’s first review something that you already know a bit of: one way SSL.

One Way SSL: An Overview

Can you see that padlock icon in your browser’s address bar? Yes, that’s a visual representation of one way SSL. Okay, let us be clearer: An SSL/TLS certificate facilitates a secure (encrypted) connection between two entities (your end user’s browser and your web server). Not only that, but it also allows for authentication between the web server and the browser.

As the SSL certificate is installed on the web server, the web browser is supposed to verify the legitimacy of the website. The web server, on the other hand, doesn’t validate the web browser. This is called “one way SSL” or one way TLS” because it allows authentication only from one end.

The entire authentication process takes place through a process regarded as an “SSL/TLS handshake.” There are a couple of different versions of the handshake that are used in HTTPS connections — namely TLS 1.2 and TLS 1.3, which is the newest. Let’s understand the TLS 1.3 handshake process a bit more in depth by breaking it down:

1. First, the client (browser) sends supported cipher suites and compatible SSL/TLS version to initiate the connection. This is called the “client hello” message.
2. In return, the web server checks the cipher suites and SSL/TLS version. Then, it shares its public certificate to the client along with the “server hello” message.
3. Upon receiving the certificate file, the client validates it. The browser then initiates the process of private key verification by generating and encrypting a “pre-master secret” using the public key of the SSL/TLS certificate.
4. In turn, the web server decrypts the pre-master secret with its private key and establishes a secure connection.

So that’s how the verification of the web server is done. This is called “one-way SSL/TLS.” But how does this differ from the two way SSL, or mutual authentication, process?

Two Way SSL: Authentication of Both Parties

Two way SSL, also known as mutual SSL certificates, are SSL certificate where the server and the client, authenticates each other for a more robust security.

Now that you understand how one way SSL/TLS works, you’d be able to guess what two way SSL is all about. Unlike one way SSL, 2 way SSL involves validation of not only the web server but also of the web browser — or what’s referred to as client authentication. Naturally, this process involves a client certificate (or what’s known as a personal authentication certificate) on the user’s end in addition to the SSL/TLS certificate on the server’s end, and each party validates the other’s certificate.

Here are the steps required for a 2 way SSL handshake process:

1. First, the client sends supported cipher suites and compatible SSL/TLS version to initiate the connection. This is called the “client hello” message.
2. In return, the web server checks the cipher suites and SSL/TLS version. Then, it sends its public certificate to the client along with a request for the client’s certificate and its “server hello” message.
3. Upon receiving the certificate file, the browser validates it. Afterward, the client sends its own SSL certificate to the server.
4. The server then verifies the client’s SSL/TLS certificate and paves the way for a secure connection with it.

That wasn’t too complicated, was it?

Why Would You Need Two Way SSL/TLS?

So, which is a better authentication method for you – one way authentication vs two way authentication?

Needless to say, two way SSL is used for places where you only want the server to accept connections from a restricted number of users. It helps to mitigate the risk of fraud in online transactions.

A typical use case of two way SSL is in organizations that want to restrict access to their platform to only their employees and/or customers.

While some organizations may choose to whitelist IP addresses to restrict user access, but that’s not an ideal practice since IP spoofing is becoming more prevalent.