During the MTLS handshake, after ServerHello is done client sends the client certificate back to the server, I need to know if the client should only send the client certificate or is it required to send the client cert along with the entire CA chain ?
I have a situation where I am seeing a handshake failure post CertificateVerify. The client cert looks good and it is signed out of subCA which is signed out of a RootCA that the server also trusts (server only trusts root ca , not the subCA), in this situation we see the client only sending back the client cert without the chain, is that why I see the handshake failure ?? I am wondering if the client sent the entire CA chain back, the server would have know that the client is signed by SubCA which is then signed by a root CA that it trusts... I have googled and found lot of information around server sending cert with CA chain and acceptable CAs to client .. but not anything around what client should do..
any help is appreciated.