Which client side configuration is essential to enable mutual TLS when calling an external API?

• A. A TLS context with a truststore
• B. A TLS context with a keystore
• C. Disable TLS on the client
• D. A pre shared key in the header

Answer: (B)

Mutual TLS requires the client to present its certificate during the TLS handshake so the server can authenticate the client. To enable this on the client side, you configure a TLS context that includes a keystore. The keystore holds the client’s private key and its certificate, which are used to prove the client’s identity to the external API.

A truststore is used to verify the server’s certificate, not to supply the client’s credentials, so it alone doesn’t enable mutual authentication. Disabling TLS would remove the encrypted channel altogether, and a pre-shared key in a header isn’t how TLS mutual authentication works because mTLS relies on certificate-based authentication at the TLS layer.

So, the essential setup is a TLS context with a keystore, which provides the client certificate for mutual authentication.