For mutual TLS when calling an external API, which client side configuration is required?

• A. an SSLContext with a truststore
• B. a TLS context with a keystore
• C. disable TLS verification
• D. a keystore in the truststore

Answer: (B)

Mutual TLS hinges on the client being able to present its own certificate and private key during the TLS handshake. That credential is stored in a keystore, and the TLS context must be configured to use that keystore so the client can authenticate itself to the external API. Without a keystore, the client cannot participate in the mutual authentication step.

A truststore alone would only allow the client to verify the server’s certificate, not present its own certificate. Disabling TLS verification would defeat security, and the notion of “a keystore in the truststore” isn’t a valid configuration. Hence the required client-side setup is a TLS context configured with a keystore.