Is it okay if the TLS versions of the client and server are different? 🤔 The Secret of mTLS Communication

Sep 11, 2026

—

When developing, you sometimes worry that the TLS (Transport Layer Security) versions might not match due to different client and server environments. Especially in an mTLS (Mutual TLS) environment, which builds stronger security through mutual authentication, this small version difference can make you anxious that the entire communication might fail.

So, if the client and server prefer different TLS versions, is mTLS communication impossible?

✅ To conclude, it’s okay! (But there are conditions)

Even if the client and server prefer different versions of TLS, if there is at least one TLS version that they both commonly support, communication can proceed without issues. The system automatically finds that common version, initiates communication, and performs mTLS authentication on that basis.

🤝 The Magical Process, TLS Version Negotiation

To understand how this is possible, you need to know about the ‘TLS Handshake’ process, the first gateway of all TLS communication. In this process, the client and server, like greeting each other for the first time, decide what encryption method and ‘language (TLS version)’ to use for communication. This is called ‘Version Negotiation’.

The overall flow is as follows:

🙋‍♂️ ClientHello: Client’s Introduction The client connects to the server and says, “Hello! I can use these technologies.” At this time, it sends a list of supported TLS versions to the server, in order from the preferred highest version.

Client ➡️ Server: “I support TLS 1.3 and TLS 1.2. If possible, I’d like to communicate with the latest version, 1.3!”

🙋‍♀️ ServerHello: Server’s Response and Decision The server looks at the list sent by the client and compares it with its own list of supported versions. Then, it selects the highest version supported by both and responds, “Okay! Let’s talk using that version.”

Server ➡️ Client: “Nice to meet you. I support TLS 1.2 and TLS 1.1. The best version we can both use is TLS 1.2, so let’s start communication with that!”

🤝 Start Communication An encrypted communication channel is created based on the negotiated TLS 1.2 version. The certificate exchange and verification procedures between the client and server, necessary for mTLS, proceed securely over this channel.

💡 When does mTLS appear?

mTLS is not an independent protocol, but an ‘authentication enhancement option’ that operates on top of the TLS protocol. Therefore, the basic TLS handshake (including version negotiation) must first be successfully completed before the mTLS authentication procedure can begin. This is why version negotiation always occurs before mTLS.

🎬 Perfect Understanding with Real-World Examples!

✅ Communication Success Scenario

Client Supported Versions: TLS 1.3, TLS 1.2
Server Supported Versions: TLS 1.2, TLS 1.1
Negotiation Result:

The client sends the list [TLS 1.3, TLS 1.2] to the server.
The server compares it with its own list [TLS 1.2, TLS 1.1].
The commonly supported version is TLS 1.2.
Finally, communication is decided with TLS 1.2, and mTLS authentication is performed normally thereafter. 🎉

❌ Communication Failure Scenario

Client Supported Versions: TLS 1.3 (only 1.3 supported)
Server Supported Versions: TLS 1.2 (only 1.2 supported)
Negotiation Result:

The client sends the list [TLS 1.3] to the server.
The server compares it with its own list [TLS 1.2].
There is no commonly supported version.
Consequently, the TLS handshake fails and the connection is terminated. mTLS authentication cannot even be attempted. 😥

👨‍💻 Peeking at Real Data: Handshake Seen with Wireshark

How does this process look in actual network packets? TLS handshake data captured with a tool like Wireshark is as follows:

1. ClientHello Packet

You can see the client sending its list of supported versions (supported_versions).

Transport Layer Security
    TLSv1.3 Record Layer: Handshake Protocol: Client Hello
        Handshake Protocol: Client Hello
            Version: TLS 1.2 (0x0303)
            Extension: supported_versions (len=5)
                Supported Versions Length: 4
                Supported Version: TLS 1.3 (0x0304)
                Supported Version: TLS 1.2 (0x0303)

ℹ️ In the data above, the client indicates that it supports TLS 1.3 and 1.2.

2. ServerHello Packet

The server looks at the client’s list and responds with the single version it has chosen.

Transport Layer Security
    TLSv1.3 Record Layer: Handshake Protocol: Server Hello
        Handshake Protocol: Server Hello
            Version: TLS 1.2 (0x0303)
            Extension: supported_versions (len=2)
                Supported Version: TLS 1.2 (0x0303)

ℹ️ The server clearly indicates that it ultimately selected TLS 1.2, considering the list sent by the client and its own capabilities.

✨ Key Summary: Just Remember This!

It may seem complex, but the core is simple.

When clients and servers communicate via mTLS, it is not a problem if their preferred TLS versions differ. The most important thing is whether there is at least one TLS version that both sides commonly support.

If there is a common version, the system will automatically negotiate to the optimal version and initiate secure communication. Now, cast aside any vague anxieties about version differences and trust the system’s smart ‘negotiation’ capabilities!