Design and build a privately hosted Public Key Infrastructure

First, the end entities will set up a connection and share certificates to prove their identity. Both end entities will check there is an unbroken chain of signed certificates (certificate path) from the peer end entity to a trusted certificate authority that's present in the trust store.

The process will not just check signatures, it will also check other parameters, such as expiry date of the certificate and key usage.

The end entity will then check that each certificate has not been revoked using a revocation checking mechanism, like a CRL or OCSP.

If everything checks out, the End Entities will continue the mutually authenticated secure protocol between them as they have now authenticated each other.