Mutual authentication is used when a user is issued a certificate from a trusted source. The certificate identifies the user in some way. To ensure the validity of X.509 certificates, Access Manager supports both Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP) methods of verification.
SSL provides:
Authentication and nonrepudiation of the server, using digital signatures
Data confidentiality through the use of encryption
Data integrity through the use of authentication codes
Mutual SSL provides the same things as SSL, with the addition of authentication and nonrepudiation of the client, using digital signatures.
Set up Access Manager certificates for security, and import them into the Access Manager system. (See Section 24.1, Creating Certificates.)
Create an X.509 authentication class. (Section 8.2.3, Creating an X.509 Authentication Class.)
Create an authentication method using this class. (Section 8.3, Configuring Authentication Methods.)
Create an authentication contract using the X.509 method. (Section 8.4, Configuring Authentication Contracts.)
Update any associated Access Gateways to read the new authentication contract. (Section 13.4, Configuring Protected Resources.)
Update the Identity Server cluster configuration. (See Section 3.2.1, Updating an Identity Server Configuration.)