Where TLS terminates

Same traffic, three configs. Watch ciphertext (locked) become plaintext (open) at the boundary each file defines — and note you move that boundary by editing YAML, never app code.

Client browser terminates here App upstream encrypted plaintext Nginx
nginx.conf


  

     locked = ciphertext
     open = plaintext
     mutual = both peers verified
  


  
The whole point: in every mode the certificate and key are just files, and the security posture is a few lines of declarative config — an Nginx server block, an Envoy transport_socket, or a Kubernetes Secret plus a PeerAuthentication CRD. Flipping the mesh to STRICT encrypts and mutually authenticates every service-to-service hop without a single line changing inside app A or app B.