90% of Zero-Trust mTLS Outages Have Nothing to Do With Cryptography

Nobody gets paged at 2:00 AM because elliptic-curve cryptography suddenly failed.

Teams get paged at 2:00 AM because an intermediate CA rotated, a Java service cached the old truststore.jks in memory without a reload hook, or a Kubernetes Secret updated on disk while Envoy or Spring Boot kept serving the expired leaf certificate.

When we design mTLS architectures, we spend 80% of our design review debating cipher suites and key lengths, and only 20% testing how workloads reload credentials under live traffic.

Flip that ratio:

1. Shorten leaf lifetimes to days, not years. A 7-day or 30-day certificate parsed by cert-manager forces your reload path to run every week while the team still remembers how it works.
2. Decouple trust bundles from container images. If rotating a root CA requires rebuilding a Docker image, you don’t have automated PKI—you have a ticking outage clock.