This question already has an answer here:
- How does SSL/TLS work? 3 answers
As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web service.
So is safe to assume, that if SSL client certificate authentication is used, possibly vulnerable, high impact web applications could be exposed to the internet without risk of access by unauthorized persons?
How does this compare to using VPN?