I'm having difficulty understanding the impact the client nonce has. I understand that the server nonce can prevent the replay attack. Isn't the client nonce an unnecessary part of the replay attack prevention? For example, a client that has the intention of initiating a replay attack can just use the same nonce that they were replaying.
In what scenario does the client nonce in SSL prevent a certain type of attack?