Which is the correct simplified TLS handshake sequence needed to authenticate clients using a mutual...

Mutual TLS (mTLS) is a security enhancement where both the client and the server provide X.509 certificates to prove their identities.9 In PingAM 8.0.2, mTLS is frequently used for secure "Machine-to-Machine" (M2M) communication, such as between an OAuth2 client and the token endpoint, or between AM and a Directory Server (PingDS).

According to the PingAM documentation on "Secure Network Communication" and "mTLS for OAuth2," the handshake sequence for mTLS follows these logical steps:

Client Hello: The client initiates the request to the server.10

Server Hello & Certificate: The server responds by presenting its own certificate (verifying the server's identity to the client).11In an mTLS scenario, the server also includes aCertificateRequestmessage.12

Client Certificate & Key Exchange: The client validates the server's certificate. If valid, the client then sends its ownClient Certificateto the server, along with the encrypted pre-master secret or key exchange data.

Verification and Establishment: The server validates the client's certificate against its truststore. If the certificate is trusted and the cryptographic signatures match, themutually secure connectionis established.

Option D represents the most accurate "simplified" sequence. Option A is incorrect because the server presents its certificatebeforethe client sends its own certificate. Option B and C are incorrect because the server always responds to the initial "Client Hello" with its own identity (Server Certificate) before the client proceeds with identity submission. This "handshake" ensures that no data is transmitted until both parties have cryptographically verified each other.