How Chrome browser know which client certificate to prompt for a site?
The client certificate authentication is ruled in the handshake phase of the SSL/TLS protocol implemented by browsers.
If the server requires a client certificate authentication (it isoptional), send a message to client with the list of the acceptedcertificate authorities (CA). Can be void if server accepts anycertificate.
The client select the certificates installed in client keystore which have been issued by any of these CA's, and present the list to user. In case of Chrome, the browser selects the certificates installed by user from the operating system's Key Store.
User choose a certificate, and the client performs a signature with the private key of the certificate over a known data interchanged during handshake.
Only certificates with private key can be selected during step 2. This is the reason by with the browser does not select the certificates of trusted CA's installed in your device. You do not own the private key