Why is a certificate needed at client side I was wondering why you need a certificate of the server at client side. Can't you just fetch it from the CA itself? I am using mbedtls to program some small client, and in all the client examples they use a certificate of the server. However, if you need to specify the server certificate to be able to make a connection to it, then how are browsers able to verify all secure websites? I don't think they have all certificates of all servers hard coded (which is off course not possible as new secure websites arise every day)
I think you are confusing something in the mbedTLS ssl_client1 example. The example does not specifiy the server certificate, but the CA (Certificate Authority) certificate. The client loads the CA certificate into its CA chain. Later on it still requests the certificate from the server (ssl_handshake step) and uses the public key inside the CA certificate to verify the certificate it received from the server.