In client side certificate authentication why, if, do we need to share the certificate

Question

Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today.

I have made some progress on the client side certificate authentication but however there's some fundamental question that can't get my head around.

I have worked with third parties that use to send the certificate (and passphrase) over and then we were able to start using their services. Unfortunately I wasn't involved at all in the process so not even sure if it's my misunderstanding. Assuming that was correct, please let me know if not, my questions are

• Do you exchange the pfx, with the private key as well as the certificate?
• If I had a certificate signed by a trusted CA why not just send that one and the server would just need to validate it? is the case that the exchanges certificates are ad-hoc ones and they just need to validate it's issued by them?
• Is this exchange where the Certificate Signing Request can be used?

I understand the question is both simple and vague but can't really see the use case of this exchange, from what I have been reading for a while

Thanks

Answer 1

Do you exchange the pfx, with the private key as well as the certificate?

Only the client certificate is provided to the server. And the client proves to the server that it has access to the private key by signing some data which are at least in part provided by the server. This is actually very similar to how it works with the server certificate.

If I had a certificate signed by a trusted CA why not just send that one and the server would just need to validate it? is the case that the exchanges certificates are ad-hoc ones and they just need to validate it's issued by them?

"Trusted CA" is what the server considers as trusted for the authentication of the client. This often does not mean that the certificate was issued by a publicly trusted CA as is preinstalled in the systems but by a private CA which the server considers as trusted for the purpose of client authentication.

Is this exchange where the Certificate Signing Request can be used?

A certificate signing request (CSR) is used when applying for a certificate. In case of a private CA trusted by the server you need to send your CSR to this private CA which then issues a certificate based on the CSR. Note that using a CSR is not mandatory. Instead it might be that you just get issued a personalized smartcard with a certificate (and the matching key) already on it without creating a CSR.