Hi,

I have a question about the usage of server and client certificate.

The server send his certificate with its Endpoint Description to the client.
The client uses the public key for encryption and signing of his next message, the OpenSecureChannel request.
Within this messages he send his client certificate to the server.
Then the server can also use the public key for signing and encryption.

Is this right?
Does the client and server exchange one public key?
So the server, for instance, uses the same private key decryption and signing?

Another question, why does the server exchange his certificate a second time?
I think he exchanges his certificate a second time in his OpenSecureChannel Response?
What is the purpose with this second exchange?

Thank you very much for your help,
Mel