What is mutual TLS and why is it common in IoT?

In standard TLS only the server authenticates itself to the client, the client verifies the server's certificate, but the server identifies the client some other way (often a password or token sent inside the encrypted channel). Mutual TLS (mTLS) makes authentication bidirectional: the client (device) also presents its own certificate during the handshake, and the server validates it, so both ends cryptographically prove their identity. It's common in IoT because it gives each device a strong, unique, cryptographic identity rather than a shared or guessable secret: the device's private key never leaves it, so an attacker can't impersonate the device without extracting that key, and the server can authorize and audit per device. Crucially it enables per-device revocation, if one device is compromised or decommissioned, you revoke just its certificate without affecting the fleet or rotating a shared secret across millions of devices. Major IoT cloud platforms use mTLS (with per-device certificates provisioned at manufacture or first boot) as the default device-authentication mechanism for exactly these reasons. The costs are operational: you must provision a unique key/certificate to every device, protect that private key (ideally in a secure element), and run a CA and revocation infrastructure, but the security benefit of unforgeable, individually-revocable device identity is why it's the IoT standard.