The server is configured to support the cipher suite
TLS_DHE_RSA_WITH_AES_128_CBC_SHA and validate the client's certificate.
My understanding is that the server uses DH for key exchange which does not require encryption or decryption but a math formula (g MOD p) to derive a secret key for both the server and client.
So in this case, if the client initiates the handshake (client hello), the TLS communication can be established just with public certificates of server and client. Is the client's private key is not required? If so, is this not an insecure configuration?
The concern is, if client's private key is not being used, any one who has client's public key should be able to connect to server over tls..? this should not be the case in IOT which uses PKI for device authentication.