I have a vague idea between REQUIRE SSL and REQUIRE X509, I just don’t understand how the client and server relationship works in terms of securing the connection.

With REQUIRE SSL, the connection from client to server is secured, but how is this happening if the client has no certificate to show? Is this the equivalent as a web browser going to a website with a self-signed certificate and getting the warning to accept before viewing the site?

And if I’m using REQUIRE X509, how does that help the server verify that the client is one of ours or is that not the case if I just install any certificate? Can X509 be configured so that the server will only accept clients with certificates from the same Certificate Authority as the server?