Distinguish one-way TLS (only the server presents a certificate) from mutual TLS/mTLS (both client and server present and validate certificates) and choose mTLS when the requirement is to authenticate the client by certificate.