Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today.
I have made some progress on the client side certificate authentication but however there's some fundamental question that can't get my head around.
I have worked with third parties that use to send the certificate (and passphrase) over and then we were able to start using their services. Unfortunately I wasn't involved at all in the process so not even sure if it's my misunderstanding. Assuming that was correct, please let me know if not, my questions are
- Do you exchange the pfx, with the private key as well as the certificate?
- If I had a certificate signed by a trusted CA why not just send that one and the server would just need to validate it? is the case that the exchanges certificates are ad-hoc ones and they just need to validate it's issued by them?
- Is this exchange where the Certificate Signing Request can be used?
I understand the question is both simple and vague but can't really see the use case of this exchange, from what I have been reading for a while