Service Authentication - Tokens or Certificates?
summary
Compares concrete tradeoffs: certificates give no secret on the wire but require secure key generation, OCSP/CRL revocation checking, and work best when validation sits close to the workload (example: Istio sidecar); tokens carry identity and traverse complex networks easily but are bearer secrets that need OAuth 2.0 token exchange for safe service-to-service delegation and very short lifetimes to limit risk. Recommends automating issuance/rotation, mixing tokens for edge/user calls and certificates inside the mesh, and using existing standards.
AI-written summary · about
chapters (6)
related talks
27mManaging a State of Distrust
32mREST security essentials
19mIdentity, Istio, And You
28mService Identity - The Key to Zero Trust with Service Mesh
56mSecuring an API Ecosystem with OAuth 2 0
34mThrow Away Your Passwords: Trusting Workload Identity
01h 06mMicroservice Authentication and Authorization
30mInsecurity protocols: an overview of modern authentication