I have a ASP.NET Core Web API, in .NET 8.0
There is one endpoint that will be called by a 3rd party and there going to pass a PFX cert to prove its them. I have no idea how to do this and tied my self in knots trying.

I have this endpoint that look like this

   [HttpPost]
   [Authorize(Policy = "RequireCertificate")]
   public ActionResult Post(PostRequest postRequest)
   {
       return Ok("Message Received");
   }

In Program.cs

//Add authorization policy for certificate-based endpoints
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("RequireCertificate", policy =>
    {
        policy.RequireAuthenticatedUser();
        policy.AddAuthenticationSchemes("Certificate");
    });
});

//Configure Kestrel to use HTTPS with a PFX file
builder.WebHost.ConfigureKestrel(options =>
{
    options.ListenAnyIP(7241, listenOptions =>
    {
        listenOptions.UseHttps(httpsOptions =>
        {
            //If one of these is wrong it will tell you when starting the projct
            httpsOptions.ServerCertificate = new X509Certificate2(
                @"C:localhost.pfx",  // Path to your PFX file
                "your_password"                  // PFX password
            );
        });
    });
});

I am trying to call this endpoint with postman, the settings are

If I call it with postman I get a 403, when I check the console is can see its in the header

I am not sure if I am close or completely down the wrong path, I have tried removing code and certs and got it the error message to change.