What distinguishes two-way TLS from one-way TLS on a Mule HTTPS listener?

• A. No truststore is needed for two-way TLS.
• B. A keystore only is required.
• C. A mandatory truststore in addition to a keystore.
• D. Two-way TLS uses a client certificate in properties.

Answer: (C)

Two-way TLS means both sides authenticate each other during the handshake. For the server to authenticate the client, it must be able to verify the client’s certificate, which requires a truststore. The server already uses a keystore to hold its own private key and certificate, but mutual TLS adds the need to trust client certificates (or their issuing CAs) via a truststore. In Mule, this is why configuring both a keystore (for the server identity) and a truststore (to validate the client identity) is necessary. This combination is what distinguishes two-way TLS from one-way TLS, where only the server presents a certificate and a truststore for the client is not required.

So the correct distinction is that a mandatory truststore in addition to a keystore is required. The other options are not accurate because: a truststore is indeed needed for mutual TLS; a keystore alone isn’t sufficient; and while the client certificate is part of the mutual TLS process, the defining requirement is having a truststore to verify the client.