User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A client certificate is something that is used with TLS/SSL to increase security of the HTTPS session. There are two parts to this

  1. The user needs to create the certificate, have it approved (which is either instant or may be delayed), and download the cert.

  2. During the sign in process, the user is prompted to select a certificate

There is a known bug with this process that makes Chrome incompatible with browser certificates of any type, even though Chrome supports the required <keygen/> HTML5 element.


Is there any good example of what this process should look like (enrollment and usage) for sites that need the utmost of security for a HTTPS session?

share|improve this question
Are you able to share a wireframe of how you imagine this working? It's probably not a process with which we're all familiar. – Matt Obee Jan 15 '13 at 16:26
I'll post a link to a working sample site as soon as NetOps opens up the firewall – LamonteCristo Jan 15 '13 at 16:31

Most browsers support directly passing a certificate back to the browser. StartSSL is the site I use for the SSL certificates for my site and they do a nice job of using the built in functionality of browsers to handle client certificate issuance securely.

Basically the user just clicks a button to get the certificate and the server generates and provides one for them. If any validation needs to be done of the user's identity, that can be handled separately before the user's certificate is considered valid for the sensitive actions.

share|improve this answer
I checked there and only see server side SSL, not client side certs for mutual authentication. – LamonteCristo Jan 15 '13 at 18:07
@makerofthings7 They issue a client side cert as their user registration. You actually only have a client certificate to represent your account. Basic user registration is free. – AJ Henderson Jan 15 '13 at 18:08
@makerofthings7 - Also, I think this is the first time I've run in to someone I recognize from Security on another portion of the network (at least on a topic that wasn't migrated) – AJ Henderson Jan 15 '13 at 18:12
ha! It's good to see you're here! – LamonteCristo Jan 15 '13 at 18:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.