I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs?
I see that some Public CAs (from CA/Browser Forum) offer signed "client authentication" certificates. What fields can I rely on in this case? Would I be able to just map the Subject Name to a user in my application and trust the CA/Browser bundle?
Can "Public CA 1" guarantee that "Public CA 2" will not sell the exact same certificate to a different company?