A client certificate is a digital certificate that a client presents during a TLS connection so a server can verify the client’s identity. In mutual TLS (mTLS), the server requests the certificate and checks it against its trust settings, including its validity period, issuer, and any configured revocation status.
Client certificates can authenticate devices, applications, or users without relying solely on passwords. They matter in cyber security because accepting an invalid or revoked certificate may allow an untrusted client to pass authentication. In practice, defenders should ensure the server actually performs the required checks: configuring a certificate revocation list alone does not guarantee that revoked certificates will be rejected.