questions about client certificates and server certificates

[laimujun]

I started signServer with docker,Here is the startup command:

sudo docker run -it --rm --name signserver
-p 80:8080 -p 443:8443
-v /home/admin/signserver.vteamcloud.com.pem:/mnt/external/secrets/tls/cas/ManagementCA.crt
-h signserver.vteamcloud.com
keyfactor/signserver-ce

     "signserver.vteamcloud.com.pem" is my generated by EJBCA at this stage server. Similarly, I generated the TLS certificate from the EJBCA server and imported it into the browser. However, when I access the Administration Web module through a browser, I am still prompted to configure the TLS client certificate.

   I want to know how to correctly generate these two certificates through EJBCA, and what is the relationship between these two certificates

[laimujun]

My doubts have been solved. The two certificates are related to each other

[mlundblad]

Good to hear!

Yes, the client certificate will be issued by the CA that issues the TLS certifcate.
When doing TLS with client-auth, the server will challenge the client to provide an authentication cert. So the TLS session is already established in the usual way, the client trusting the TLS issuer. Then the client provides a matching client cert (the browser would typically offer those certs matching the TLS server) and then on the server-side we can check the client cert (serial number, subject depending on the match rule) and rely on the TLS layer (in the app server normally) verifying that the client is "TLS authed" already.