Multi-Audience mTLS: 3 SNI Hosts, 1 Listener, and Session Cert Binding Against Cookie Theft (opens in new tab)

In the previous articles of this series, we covered PKCS#12, timing oracles, lockout, and CSRF. All on an authentication service running mTLS. Let's talk about the TLS layer itself. The service serves three distinct audiences: a web UI for end users (no client cert), an API for internal services (mTLS required), and an admin interface (mTLS required with different CAs). Three trust levels, one port. One listener, three configs via SNI The historical solution: three ports, three listeners, thr...