In SSL/TLS protocol, what kind of authentication is supported when you establish a secure session between a client and a server?

While SSL/TLS establishes a secure session between two parties, the authentication process is generally asymmetric with mandatory server authentication and optional client authentication, rather than a fully symmetrical peer-to-peer mandatory exchange.

Server authentication is a crucial and typically mandatory step in SSL/TLS to prevent Man-in-the-Middle attacks and establish trust, not an optional feature.

During an SSL/TLS handshake, server authentication is mandatory by default, allowing the client to verify the identity of the server using its digital certificate. Client authentication, where the server verifies the client's identity through its certificate, is an optional feature used in scenarios requiring mutual authentication.

Role-based authentication is an access control concept that determines what actions a user can perform based on their role, which is distinct from the identity verification process during an SSL/TLS session establishment.