In normal TLS only the server proves who it is. In mutual TLS the server asks for a client certificate too and rejects the connection if it is missing or not signed by a trusted CA. It is common between internal services.