A client sends a request to access to protected information on the server.

2. The server presents its X.509 certificate to the client.

3. The client verifies the server’s certificate by validating the digital signature of server’s public key using CA’s public key.

4. If the last step is successful, the client sends its certificate to the server.

5. The server verifies the client’s certificate using the same approach in step 3.

6. If successful, the server gives access to the protected information to the client.

https://benpournader.medium.com/what-is-two-way-tls-d90600e2fc06