I understand that a client and server certificate is required, however the validation process isn't clear to me.

Is it simply that the certificates are check to ensure they're valid, aren't revoked, and are signed by the same root ca? Can certificates from different root CAs (both trusted by client and server) be used? Are there any other specific checks?



If CA certificates are trusted by client and server both, than an CA certificate will work. However, apart from CA Signer (CA certificates), you can also validate the certificate subject CN name. [ this functionality is not provided by all the product ]

Process in details:

  1. Negotiation (SSL Handshake)
  2. Server Sends its Server Certificate to Client. (s - > c)
    2.a Client validate that signer of certificates provided by server is in its trust-store.
  3. Client Sends its Client Certificate to Server (c -> s)
    3.a Server validates that the signer of certificate provided by client is present in it's trust-store.
  4. Than, they exchange master-key.
  5. Handshake done, and data transmission over synchronise encryption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.