How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do servers typically have some sort of configuration to specify the subject names of certs they want to trust, or fingerprint values?
In one scenario a private CA acting on the server's behalf could sign the client certs so that ONLY their certs would be accepted. In another scenario the server trusts certs signed by any "regular" trusted CA (of the client's choosing) in their trust store. But if your system is to be closed (as in a business-to-business case) then you want additional filtering.
I realize at the application level if the cert chain is available then any further custom filtering can be done. But I just want to know in the real world, out of the box, what additional config web servers have to deal with this today during the TLS handshake.