In normal HTTPS the server proves its identity (that padlock in your browser). In mutual TLS, the client also presents a certificate. Both sides prove who they are before a single byte of application data is exchanged. It's how banks talk to each other and how Kubernetes services trust one another inside a mesh.
Both certificates are checked against a trusted Certificate Authority. If either fails — expired, self-signed, wrong CA — the connection is dropped before HTTP even starts.