Tell me more ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.
up vote 0 down vote favorite
1

A client certificate is something that is used with TLS/SSL to increase security of the HTTPS session. There are two parts to this

  1. The user needs to create the certificate, have it approved (which is either instant or may be delayed), and download the cert.

  2. During the sign in process, the user is prompted to select a certificate

There is a known bug with this process that makes Chrome incompatible with browser certificates of any type, even though Chrome supports the required <keygen/> HTML5 element.

Question:

Is there any good example of what this process should look like (enrollment and usage) for sites that need the utmost of security for a HTTPS session?

share|improve this question
Are you able to share a wireframe of how you imagine this working? It's probably not a process with which we're all familiar. – Matt Obee Jan 15 at 16:26
I'll post a link to a working sample site as soon as NetOps opens up the firewall – makerofthings7 Jan 15 at 16:31

1 Answer

up vote 1 down vote

Most browsers support directly passing a certificate back to the browser. StartSSL is the site I use for the SSL certificates for my site and they do a nice job of using the built in functionality of browsers to handle client certificate issuance securely.

Basically the user just clicks a button to get the certificate and the server generates and provides one for them. If any validation needs to be done of the user's identity, that can be handled separately before the user's certificate is considered valid for the sensitive actions.

share|improve this answer
I checked there and only see server side SSL, not client side certs for mutual authentication. – makerofthings7 Jan 15 at 18:07
@makerofthings7 They issue a client side cert as their user registration. You actually only have a client certificate to represent your account. Basic user registration is free. – AJ Henderson Jan 15 at 18:08
@makerofthings7 - Also, I think this is the first time I've run in to someone I recognize from Security on another portion of the network (at least on a topic that wasn't migrated) – AJ Henderson Jan 15 at 18:12
ha! It's good to see you're here! – makerofthings7 Jan 15 at 18:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.