I have a private application - that has one server and many clients and I want to use two way authentication(AKA client auth) I use Tomcat server and java keytool to create TLS certificates.
If I create one certificate authority, and create on certificate (signed by the CA) for the server, and pre-install it for all clients - then they can authenticate server (although I didn't really had to sign it with the CA, but anyway)/
If I create a client certificate, sign it with the CA, and then install it on the client:
Does the server need to hold the client certificate(and the CA) or just the CA in the truststore? And by that I mean - Is there any place that I need to "Remember" the client certificate and check against an existing file(that will of course - match one to one with the certificate the client sent)
Or is it enough to just check the signature of the CA on the certificate, causing that just one copy of the client certificate exists in my system, and cryptographically - it is secured to assume that if the signature of the CA exists(and validates) on the certificate a client sent me - it is the client