Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual page 811

Figure K-3 Authentication and Verification of a Client Certificate
An SSL-enabled server goes through these steps to authenticate a user's identity:
Does the user's public key validate the user's digital signature? The server checks
1.
that the user's digital signature can be validated with the public key in the certificate. If
so, the server has established that the public key asserted to belong to John Doe
matches the private key used to create the signature and that the data has not been
tampered with since it was signed.
At this point, however, the binding between the public key and the DN specified in the
certificate has not yet been established. The certificate might have been created by
someone attempting to impersonate the user. To validate the binding between the
public key and the DN, the server must also complete Step 3 and Step 4.
The SSL Handshake
Appendix K Introduction to SSL 811