Securing Microservices
&gt; <i>A signed JWT is known as a JWS (JSON Web Signature) and an encrypted JWT is known as a JWE (JSON Web Encryption). In fact a JWT does not exist itself — either it has to be a JWS or a JWE. It’s like an abstract class — the JWS and JWE are the concrete implementations.</i><p>This is backwards; a JWT is the payload of (usually, IMO) a JWS, sometimes a JWE. But not all JWSs&#x2F;JWEs are JWTs, so JWE&#x2F;JWS cannot be called a concrete implementation of a JWT.<p>&gt; <i>Both in TLS mutual authentication and JWT-based approach, each microservice needs to have it’s own certificates.</i><p>JWT doesn&#x27;t, to my knowledge, make use of certificates. I&#x27;m less clear on the JWE cases, but JWS&#x27;s only carry the algorithm used to do the signing, and the signature. You have to know&#x2F;figure out what key signed it to verify it.<p>Further, if you&#x27;re using the HMAC algorithms, you&#x27;re definitely not using a cert.