RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 （opens in a new window）
The protocol behind mTLS point-to-point encryption, including the handshake flow and the reasoning behind forward secrecy.
rfc-editor.org
Resources
Standards and specifications
These links point to public material from government agencies, standards bodies and non-profit organisations. They are not owned by Kunan Technology; the publishing body is authoritative.
9 references
RFC 9325: Recommendations for Secure Use of TLS and DTLS （opens in a new window）
Concrete guidance on which cipher suites to enable and which versions to disable — more directly applicable to configuration than the protocol document itself.
rfc-editor.org
RFC 5280: X.509 Public Key Infrastructure Certificate and CRL Profile （opens in a new window）
The rules for chain validation, validity periods and revocation — the foundation for designing a device identity certificate hierarchy.
rfc-editor.org
SP 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management （opens in a new window）
Defines authenticator assurance levels, and is the original source for modern practices such as not forcing periodic password rotation.
pages.nist.gov
SP 800-162: Guide to Attribute Based Access Control (ABAC) （opens in a new window）
An authorisation model that adds contextual attributes on top of RBAC — the next reference when service-level segmentation policy needs finer granularity.
csrc.nist.gov
SP 800-53 Rev. 5: Security and Privacy Controls （opens in a new window）
The full control catalogue, commonly used to map contractual security clauses and client audit items back to something specific.
csrc.nist.gov
Application Security Verification Standard (ASVS) （opens in a new window）
A checkable list of application security requirements, well suited to being written into acceptance criteria for outsourced development.
owasp.org
Web Security Testing Guide (WSTG) （opens in a new window）
The open methodology for penetration testing — useful for checking whether the scope of an engagement you commissioned is actually complete.
owasp.org
Common Vulnerability Scoring System (CVSS) （opens in a new window）
The scoring standard for vulnerability severity. Reading the vector string is what tells you whether a high score is actually high risk in your environment.
first.org