Which certificate should the customer use?
The customer should be using a RSA certificate if it required from by their API Configuration.