Mutual Authentication

With mutual authentication, the server and the client authenticate each other. Mutual authentication is of two types:

• Certificate-based (see Figure 25–4)

• User name/password-based (see Figure 25–5)

When using certificate-based mutual authentication, the following actions occur.

1. A client requests access to a protected resource.

2. The web server presents its certificate to the client.

3. The client verifies the server’s certificate.

4. If successful, the client sends its certificate to the server.

5. The server verifies the client’s credentials.

6. If successful, the server grants access to the protected resource requested by the client.

Figure 25–4 shows what occurs during certificate-based mutual authentication.

Figure 25–4 Certificate-Based Mutual Authentication

In user name/password-based mutual authentication, the following actions occur.

1. A client requests access to a protected resource.

2. The web server presents its certificate to the client.

3. The client verifies the server’s certificate.

4. If successful, the client sends its user name and password to the server, which verifies the client’s credentials.

5. If the verification is successful, the server grants access to the protected resource requested by the client.

Figure 25–5 shows what occurs during user name/password-based mutual authentication.

Figure 25–5 User Name/Password-Based Mutual Authentication