Apache Thrift 2-way SSL mutual authentication

Question

I have found a few examples online that deal with SSL connections in Apache Thrift, but I have yet to find a 2-way SSL (mutual authentication) example anywhere. Unless I am completely misunderstanding the example below. Essentially, I have a jboss application server that does 2-way authentication, however I would like to start using Thrift to move some items into a micro service architecture. Any help is greatly appreciated.

SSL client server

Answer 1

It is indeed possible to secure Thrift with 2-way (mutual) TLS, so that the client and server both verify each other's identities. While the guide linked in the question above only shows how to make the client verify the identity of the server, you can do the reverse by creating the equivalent private-key/cert pair for the client. Then set the clientAuth boolean to true when creating the server. See the docs for the clientAuth parameter: https://people.apache.org/~thejas/thrift-0.9/javadoc/org/apache/thrift/transport/TSSLTransportFactory.TSSLTransportParameters.html#clientAuth