Question

A server often wants to authenticate a client. The SSL/TLS handshake protocol includes the possibility to authenticate the client, but this possibility is typically not used on the Internet when requesting SSL/TLS protected webpages. Why?

Answer 1

For a better understanding, one should first understand The Basic phases of SSL/TLS.
Steps used in SSL:

1.Establish Security Capabilities - used by
the client to initiate a connection and to
establish security capabilities.

2.Server Authentication and Key Exchange -
The server sends its
certificate if it needs to be authenticated.

3.Client Authentication and Key
Exchange - the client verifies that the
the server provided a valid certificate and check that the server's hello
parameters are acceptable.

4. Finish - this phase completes the
setting up a secure connection.

So, For most of the large web pages(Websites with a very large number of visitors) performance matters a lot.

SSL Handshake Protocol performance is not considered to be that high if we talk about web pages since the information that client send has to be encrypted by the server, it takes more server resources than if the information weren’t encrypted.

So, the Cost of performing above four steps of SSL/TSL Handshake for web pages especially for large web pages are comparably high. So, Handshake Protocol is typically not used on the internet when requesting SSL protected web pages.