Project developed to demonstrate mutual TLS (mTLS, or Two-Way SSL) authentication using ASP.NET Core. It was based on the official documentation.
The generated certificates are located on the "Certificates" directory. Don't forget to add the CA certificate to the trusted root.
The WebAPI validates the client's certificate by checking if its thumbprint exists on the "ClientCertificates" allowable list on the "appsettings.json" file.
In order to test the WebAPI using Postman you must add the client certificate as described here. Simply add the "child_a_dev.pfx" file.
There is also a client console project ("ClientSample") that consumes the WebAPI using the client certificate.