Can someone please explain me how the client proves its identity to the sever and how authenticity of the client certificate is verified by server?

Let’s assume server is configured to ask for client certificate during handshake.

Thank You


The basic principle for client certificate authentication is the same as for server certificate validation.

It is assumed that a Certificate Authority (CA) is trusted to sign certificates for clients, so verifying that the certificate is signed by a Trusted CA confirms the identity of the client.

Since authenticating a client is usually the responsibility of a private entity (like a corporation), most client certificate authentication operates with a "self-signed" CA. The CA certificate is then loaded into the server application and client certificates on incoming connections are compared against the CA certificate.

  • Thank You. So the client certificate contains the digital signature which is encrypted by the private key of the server, in this case CA. Once this certificate is presented to the sever, it creates a hash of the certificate and decrypts the digitial signature using its public keys? I am not sure what keys are used to encrypt the digital signature of the client certificate. – asad Apr 2 '18 at 2:38
  • To clarify, the general principle of x509 certificates works like this: The client generates a key pair (usually RSA). They use the private key to sign a certificate signing request, which pairs their public key with some information about themself. The CA uses it's private key to digitally sign the request details which becomes the certificate. The certificate is as public as the public key... there's nothing encrypted about it, but it is verifiable as originating at the client, and verified by the CA. Encryption only comes into play for the TLS session key exchange. – nbering Apr 2 '18 at 2:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.