Till now I understood Client Authentication as a way to limit access for certain clients.
But after reading https://en.wikipedia.org/wiki/Transport_Layer_Security#Client-authenticated_TLS_handshake I am not that sure anymore and would like to discuss here to get my eyes opened.
It is all theoretically.
The client does have a keypair. In the handshake it sends the certificate (the signed pubkey) and also a signed random data. Because the server uses the sent cert to verify the signed data is knows the client is in possession of the privkey too. And because of the chain-of-trust and the issuer the server also does know that the client is authentic.
And there is absolutely no need that the clients cert must be signed with the servers key. It can be any issuer as long the server can verify the clients chain-of-trust. But that depends of the servers CA.
To design the limited access we can use the CA. Put only the servers keypair in it and only clients would be able to access that uses certificates that are signed with the servers CA. All others will not pass the verify because the chain-of-trust.
Is my view correct?