anchor.diff:  
   Let's assume 'node' refers generically to a participant in our system, either a gateway or a service.
   
  -There are two main elements we need to work with: *keystores*, which contain a node's private key material, and *truststores*, which contain public certificates instructing the node who it should trust.
  +There are two main elements we need to work with: *keystores*, which contain a node's private key material, and *truststores*, which contain public certificates instructing the node whom it should trust.
   
   Ideally, each node should have its own keystore, whose key material is signed by a *trusted certificate authority*; a trusted party whose signature indicates that the holder of the certificate is trustworthy. In many organisations there is an internal certificate authority which will sign or issue certificates. If we add a CA's certificate to our node's keystores, then _any_ certificate issued by it will be trusted by virtue of the issuer's authority. This approach scales excellently, because we can issue an unlimited number of new certificates without needing to add them to our truststores.
   
  
positive.code: 
  === Truststore
  
  Let's create a simple shared truststore that we'll use on all of our nodes. We're going to imagine that we have an internal root CA called `apimanCA`, and that whomever controls it has taken http://vignette3.wikia.nocookie.net/en.futurama/images/3/33/No9man.png/revision/latest?cb=20100317031031[appropriate security precautions] to ensure no baddies get their certificates signed.
  
  ```ShellSession
  keytool -import -keystore shared_trust_store.jks -file apimanCA.cer -alias apimanCA
  
negative.code: ---
  layout: post
  title:  "Cover yourself up! Protecting your services with mutual auth"
  date:   2015-06-16 17:00:00 +1
  author: marc_savy
  categories: gateway security mutual-auth ssl mtls
  ---
  