I am trying to understand how the client is authenticated to the server during mutual tls
So during the handshake, the client sends this message
Client — CertificateVerify This message is used by the client to prove the server that it possesses the private key corresponding to its public key certificate. The message holds hashed information (hash of all the messages exchanged so far during the handshake process) which is digitally signed by the client. It is required if the server issued a CertificateRequest to the client, so that client has sent a certificate in response which needs to be verified in server-side.
My confusion is here "server that it possesses the private key corresponding to its public key certificate."
The certificate is issued from a certificate authority. So the ca is using its private key to sign the certificate. How the client has the private key of the certificate?