---
layout: docs
page_title: Secure service mesh overview
description: >-
  This topic provides an overview of Consul's features for securing service mesh communication when running Consul on virtual machines (VMs). Consul enforces zero-trust security using a built-in mTLS certificate authority (CA) and service intentions.
---

# Secure service mesh on VMs overview

This topic provides an overview for securing service-to-service communication within a service mesh when running Consul on VMs. You can configure an mTLS certificate authority and intentions based on service identity to secure intra-mesh communication.

For information about gossip encryption and securing your Consul deployment with the Access Control List (ACL) system, refer to [Secure Consul](/consul/secure) in the Consul Operations section.

## Introduction

With Consul, a fully configured service mesh is one that enforces _zero-trust security_ by securing service-to-service communication in the following ways:

- Sidecar proxies encrypt and decrypt a service's traffic using an mTLS certificate signed by Consul
- Sidecar proxies deny incoming requests by default
- Sidecar proxies authorize incoming requests according to explicitly defined service intentions

## Certificate authority

@include 'text/descriptions/certificate-authority.mdx'

## Service intentions

@include 'text/descriptions/service-intention.mdx'

## Tutorials

To learn more about the workflows described in this topic, refer to the [Securely connect your services with Consul service mesh on VMs tutorial](/consul/tutorials/get-started-vms/virtual-machine-gs-service-mesh).

## Reference documentation

For reference material related to Consul's service mesh security options on VMs, refer to the following pages:

- [`/connect/ca` HTTP API endpoint reference](/consul/api-docs/connect/ca)
- [`/connect/intentions` HTTP API endpoint reference](/consul/api-docs/connect/intentions)
- [`consul connect ca` CLI command reference](/consul/commands/connect/ca)
- [`consul intention` CLI command reference](/consul/commands/intention)
- [Consul agent configuration reference](/consul/docs/reference/agent)
- [`service-intentions` configuration entry reference](/consul/docs/reference/config-entry/service-intentions)

### Constraints, limitations, and troubleshooting

@include 'text/limitations/secure-mesh.mdx'