Scenario: I need to implement MTLS between three of my services communicating with each other.
Based on my understanding of MTLS, I need to import the certificate of target services in the trust store of the source service and the certificate of source service in the target service. My certificate requires renewal every 15 days. At the time of renewal of each certificate, I need to go to the other services' trust store where the certificates are stored and update the certificate. e.g if I want to update the certificate of service-1 I need to go to service-2 and service-3 trust store as well and update the certificate there as well.
This seems to be a lengthy and unmanageable process once the size of infrastructure will increases. Based on the information available on the internet I have found that HSM can be used as a centralized certificate store and no matter the size of infrastructure certificate renewal can happen at a single shot at HSM itself.
But what is the way to handle the MTLS? How do source service and target service exchange the certificate if it is not stored on their local but in HSM?