I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far:
Mutual auth is a way for the client to authenticate itself to the server, just like the server does to client during (1-way) SSL connections. Web browsers are preloaded with the certs of well known CAs, so, when a website sends it's public key (something like a .cer file?) the browser can use the CA's certificate to figure if this received certificate is valid or not. Similarly, in 2 way SSL, the server needs to have the client's CA's certificate, or the self signed certificate using which the client's certificate was generated to confirm if the client is authentic or not.
Following are some specific questions about which I'm not yet clear and I'd appreciate if someone could verify my understanding:
- The certificate that the server sends for 1 way SSL just contains the public key of the server right? Is this necessarily a .cer file, or something like a .cer file?
- The CA certificates that the browsers come preloaded with - are they like .pfx certificates? And just having these certificates is enough for the browser to confirm if the cert received from the server is a valid one or not?
- In case of self signed certs, does the server need to have the .pfx self signed certificate from which the client certificate was created?
I guess it's clear from my questions that I'm not even sure when the public key and when the private is key is used to encryption/decryption, so when you answer these questions, I'd appreciate it if you could also mention which keys are used for what purpose when a specific certificate is used.