In mutual TLS, during client-authentication phase, a client proves its identity to the server by sending its client certificate (Certificate message). Additionally, it signs all previous handshake messages using its private key and sends the resulting hash (CertificateVerify message). Server uses this hash to validate client's ownership of the certificate.
What is the security benefit of the doing CertificateVerify validation above? How
cert can be compromised while
A typical key storage/management logistics for client
key+cert is "bundled". Usually, when server issues client certificate to a particular client - it supplies
key+cert (often bundled into a single
PFX file, or
PEM file with both parts concatenated), and all client APIs (OpenSSL, curl, Node.js request, etc.) expect both
cert to be supplied. Therefore, a client reasonably deals with
cert local storage/protection the same way.
Since they're typically bundled - what benefit/reason there is for
key-verification of a
cert? Why supplying just
cert would not be good enough?
Official definition and reasoning (which is not convincing to me, per the above):
EDIT (to emphasize the client cert is self-signed by the server):
It is clear that for well-known-CA signed client certificates,
key is indeed required. That's because in such case - client's
cert is publicly known.
However, in most real-life cases I saw - the server is a well-known entity, while clients are not (or the server doesn't care if they are, and still issues, and expects to get, self-signed certs of its own). Since clients are not well-known entities - arranging a well-known-CA registration for each client - is not practical. In other words, the server issues the
key+cert. And then - the question is - is there still any security benefit of supplying
key-verified hash, in addition to
cert during mTLS client auth?
Does it only exist in the protocol to cover the case when client cert is issued by a well-known-CA, i.e. for cases when client
cert is protected differently than
key? Or there's some solid reason for
key in self-signed scenario as well?