Can someone please explain me how the client proves its identity to the sever and how authenticity of the client certificate is verified by server?
Let’s assume server is configured to ask for client certificate during handshake.
The basic principle for client certificate authentication is the same as for server certificate validation.
It is assumed that a Certificate Authority (CA) is trusted to sign certificates for clients, so verifying that the certificate is signed by a Trusted CA confirms the identity of the client.
Since authenticating a client is usually the responsibility of a private entity (like a corporation), most client certificate authentication operates with a "self-signed" CA. The CA certificate is then loaded into the server application and client certificates on incoming connections are compared against the CA certificate.