I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For this, I used the .NET provided C# methods to perform this (adding "client.pfx" to the client certificates with the request).
One of my concerns I have is that the API of this 3rd party mentions that I should perform this secure call using a URI they've provided as part of their auth process. To me, this seems terrible because an attacker could provide arbitrary URLs, and receive the requests themselves, and in turn, the contents of client.pfx.
My question is, how does this client authentication work (from sort of a broad view)? Is the entire certificate sent as part of the request? Is it just a signature of the request signed with the private key in client.pfx? I'm wondering if my worry is justified.