We're building a webservice for a third party customer who wants us to use "two-way SSL". By which I understand them to mean they want us to host the site using https, and to require that include a Client Certificate in each http request.
I've been working through a number of examples on how to make all this work with the tooling we use, and I think I'm beginning to get a handle on it.
If I'm understanding correctly, we'll provide them with a certificate. They have their client include it in their requests, and we validate that the certificate we receive is what we expect.
What's not clear to me is whether it's usual for us to have the certificate created by a CA, or for us to do it ourselves. With SSL certificates, an unsigned cert is meaningless. But with client certs, we're expecting to receive a specific cert, so I'm not sure I see that validating that everything is signed back to a recognized root authority really matters.
Do people generally use CA-signed client certs, regardless?