# mTLS Labs

Companion code for "The mTLS Bible". Two independent labs with the same architecture:

    you --HTTP--> service-a :8080 --mTLS--> service-b :8443

| Folder | Stack | Start |
|---|---|---|
| `python-lab/` | Python 3 stdlib + OpenSSL, no dependencies | `./gen-certs.sh && docker compose up` |
| `java-lab/`   | Java 21 + Spring Boot 3.3, plus a plain-JDK client | `./gen-certs.sh && docker compose up --build` |

Each folder has its own README with numbered exercises (E1-E10, J1-J10).
Both include `add-intermediate.sh`, which adds an intermediate CA (doc section 2) and shows
the missing-intermediate failure. Run it after `gen-certs.sh`.

No Docker? Each README explains how to run the services directly
(`CERT_DIR=certs python3 service-b/server.py`, or `mvn spring-boot:run`).

The Python lab only needs Python 3 + OpenSSL. You can run the two labs together:
the certificates are the contract, so the Java service-a can call the Python service-b and vice versa.