I am working on integrating Salesforce with a bespoke system using APEX Http callouts and one of the security requirements is to allow two way SSL. Apex supports this by allowing you to attach a certificate to the HTTP request:
The security team need to know where this certificate is presented. At the application layer or at a lower layer of the OSI model. I have done a callout using a certificate to a HTTPs endpoint but cannot see any information regarding the certificate in either the headers or the body.
When using setClientCertificateName for an Apex HTTPs callout how is this certificate presented to the server?