So we are on this project with a partner that should use one of our API. The bosses decided the communication should use TLS mutual authentication.
On the server hosting the API, we installed long ago a certificate issued by a well-known public CA.
In my (quite lacking) understending of PKI, we do not need to send our partner any certificate. When initiating the connection, their system (as client) will simply ask for our server's certificate, and verify it with the CA. If they also installed a 'public certificate' on their client, the server should be able to verify it with the CA, and the communication will be mutually authenticated. Then the client and server would agree on a common mean of encrypting the channel.
Am I at least partially right in my understanding of mutual authentication using certificates ?
If so, why is our partner asking for us to send them the entire certificate used on our server ? They say they need the certificate containing the public key. Why would they need it in advance ? If we send them the entire certificate, it will also contain the private key, meaning the partner will be technically allowed to spoof our identity. Am I still right ?
Any advice regarding this situation ? Anything I missed ? I was never a genius with certificates...
Thanks in advance for your help !