Nehtdx

I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?

I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?

My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?

Would be this the right/possible way to do this or am I completly on the wrong track?

Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).

It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.

One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.

This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.