Developer's Guide to Web Application Security

4. The client checks the domain name in the server’s certificate, to determine

if it matches the actual domain name of the server itself.

Figure 11.6 Server Authentication for Establishment of an SSL Session

Client Authentication

The server may request client authentication to verify it is communicating with the

same client that initiated the session, after this process occurs.The steps for client

authentication are also outlined here and illustrated in Figure 11.7:

1. The server checks the user’s digital signature to see if the public key in the

user certificate can validate it.

2. The server checks the user certificate to see if the current date and time ...