If the server wants to use authentication by client certificate
Send down the certificate request The server sends down- What certificate types it supports
- What signature algorithms it supports in preferred order – so it can check the certificate sent to it
- A list of the “certificate authority” certificates from the trust store. This can include self signed certificates
- For each signature algorithm in the list, in turn
- .. For each certificate authority certificate
- …. if the trust store has an entry matching the signature algorithm and the keystore; and the entry has a private certificate
- …. Then use it
- Else return “empty” – no certificate match the keystore.
ColinPaice 