Tweeted twitter.com/StackSecurity/status/783181441844842496
2 deleted 2 characters in body
source | link

Client authentication may be used in a SSL/TLS negociationnegotiation.

For this, the client will send a Certificate Verify Message after the server requested it.

The Certificate Verify Message contains the client certificate that will be verified by the server.

My question is: how does the server verifiesverify that the client certificate (containing the client public key) is legitimate?

Client authentication may be used in a SSL/TLS negociation.

For this, the client will send a Certificate Verify Message after the server requested it.

The Certificate Verify Message contains the client certificate that will be verified by the server.

My question is: how does the server verifies that the client certificate (containing the client public key) is legitimate?

Client authentication may be used in a SSL/TLS negotiation.

For this, the client will send a Certificate Verify Message after the server requested it.

The Certificate Verify Message contains the client certificate that will be verified by the server.

My question is: how does the server verify that the client certificate (containing the client public key) is legitimate?

1
source | link

How does a server validate the Certificate Verify message in SSL/TLS?

Client authentication may be used in a SSL/TLS negociation.

For this, the client will send a Certificate Verify Message after the server requested it.

The Certificate Verify Message contains the client certificate that will be verified by the server.

My question is: how does the server verifies that the client certificate (containing the client public key) is legitimate?