I have found this explanation about how a Client-Authentication works during SSL-Handshake. So according to oracle a client-authentication works as follow:
- The Client sends his certificate, random-data and a signiture of that random data to the server.
- Server verify the signiture of the random-data using the public key in the certificate.
- The server checks the certificate’s validity period.
- Server checks if the CA in the certificate is a trusted CA.
- Server uses the public key of the CA to verify the signiture in the certificate.
After these five steps the User is authenticated.
Question: If an Attacker gets the User certificate, the random-data and the signiture of that random-data, is the attacker able to start a replay-attack?
I think that the random-data must be chellange to prevent against a replay-attack. So what is the common way to authenticate a user by using a client-certificate?