Q:

How client's SSL/TLS certificate is sent from a client (browser) to a server

I'm wondering, how (on the HTTP level), client's SSL/TLS certificate is sent over from a client (browser) to a server.
Is it sent within the header, cookies, is there some additional 'preflight' requests done before the actual HTTP request.
Do you have some insight on this?

A:

The Client certificate is not sent on the HTTP level at all. It is sent on the SSL/TLS level within the initial TLS handshake if it was requested by the server. For details and nice pictures see https://blogs.msdn.microsoft.com/kaushal/2015/05/27/client-certificate-authentication/

