What is different in mTLS compared to TLS as it pertains to truststores and keystores?

• A. In TLS, the client has a keystore only; in mTLS, both sides lack keystores.
• B. In TLS, the server has a keystore; in mTLS, the client has a keystore only.
• C. In TLS, the client has a keystore and optional truststore. In mTLS, the server also has a keystore and optional truststore.
• D. In TLS, both sides require a password; in mTLS, no passwords are used.

Answer: (C)

Mutual authentication is the key difference. In TLS (one-way authentication), the client simply verifies the server’s certificate using a truststore, while the server uses a keystore to present its own certificate. The client doesn’t inherently need a private key for the server to authenticate it, unless client certificates are requested. In mutual TLS, both sides must prove their identity, so each side holds a keystore with its private key and certificate, and each side has a truststore to verify the peer’s certificate. This means the server also maintains a keystore (for its own identity) and a truststore (to validate the client), in addition to what the client holds. That distinction aligns with the idea that TLS centers on the client's and server’s verification, while mTLS requires both sides to present and validate certificates.