I'm trying to integrate with a 3rd party service and they have requested our server's public key. I've sent it to them and they said they have configured it on their end. In order for me to make requests to them, they claim I must include the certificate with the request.
How exactly does this scheme work? I don't see how a Diffie-Hellman exchange can work in this case. Any scheme I think of can easily be broken in the case of a MITM. We have no way of generating the secret and sending it to them securely like a standard handshake. But if they generate the secret, how can they send it back and prove it was them who generated it?
I am using cURL so I assume they want me to make the request with the --cert flag (includes public and private key).
--cert tells curl to use the specified client certificate file when getting a file with HTTPS, FTPS or another SSL-based protocol. The certificate must be in PKCS#12 format if using Secure Transport, or PEM format if using any other engine. If the optional password isn't specified, it will be queried for on the terminal. Note that this option assumes a "certificate" file that is the private key and the client certificate concatenated.