It's pretty weird for an API to ask for a client certificate. We have a client certificate authentication in one of our projects. We hold the root CA key (self

It's pretty weird for an API to ask for a client certificate. We have a client certificate authentication in one of our projects. We hold the root CA key (self-signed), and this key is used to sign intermediate certificates, whose root private keys are held by our resellers. They issue client certificates, so we can easily find the reseller and end user. With a public CA issueing client certificates, I wonder how you can authenticate clients at all, because any root CA can issue certificates now. Or perhaps they are asking for S/MIME certificates?