I am trying to understand how client certificate authentication works in an SSL handshake. Can someone help to clarify the following bullet points below:
Do we need to have a Client Leaf certificate in Server truststore? Is it referred to at any given time during the two-say SSL handshake process? What if it is present, will it be ignored?
In server Hello message there is a
certificate_listmessage. This contains a list of CA or Inter CA which would have a signed client certificate. Clients will check this list and only send client certificate if its signed by CA or Inter CA present in the list. Is this understanding correct?
Once the client sends the client certificate to server, the server will check if it's signed by a known CA (CA present in
certificate_listin server hello), if that's the case then server is sure that the certificate name (
cn) in certificate is legitimate. However at this point the server is unsure if the client has a private key of the client certificate or not (could be that the client has got a client certificate through an illegitimate way), hence server expects the
certificate_verify messagefrom client. That message is signed by the private key of client and since server is able to decrypt that message through the public key of client (which the server received in an earlier message through the Client Certificate) the server can now confirm Client is what it claims to be. Is this correct?
What is the content of the
In this case how servers differentiate between clients. Do servers check client
CNand accept and reject client based on that? Without this the server will accept all clients if they have legitimate certificate, right?