0

A client certificate is something that is used with TLS/SSL to increase security of the HTTPS session. There are two parts to this

  1. The user needs to create the certificate, have it approved (which is either instant or may be delayed), and download the cert.

  2. During the sign in process, the user is prompted to select a certificate

There is a known bug with this process that makes Chrome incompatible with browser certificates of any type, even though Chrome supports the required <keygen/> HTML5 element.

Question:

Is there any good example of what this process should look like (enrollment and usage) for sites that need the utmost of security for a HTTPS session?

  • Are you able to share a wireframe of how you imagine this working? It's probably not a process with which we're all familiar. – Matt Obee Jan 15 '13 at 16:26
  • I'll post a link to a working sample site as soon as NetOps opens up the firewall – technology_is_overrated Jan 15 '13 at 16:31
1

Most browsers support directly passing a certificate back to the browser. StartSSL is the site I use for the SSL certificates for my site and they do a nice job of using the built in functionality of browsers to handle client certificate issuance securely.

Basically the user just clicks a button to get the certificate and the server generates and provides one for them. If any validation needs to be done of the user's identity, that can be handled separately before the user's certificate is considered valid for the sensitive actions.

  • I checked there and only see server side SSL, not client side certs for mutual authentication. – technology_is_overrated Jan 15 '13 at 18:07
  • @makerofthings7 They issue a client side cert as their user registration. You actually only have a client certificate to represent your account. Basic user registration is free. – AJ Henderson Jan 15 '13 at 18:08
  • @makerofthings7 - Also, I think this is the first time I've run in to someone I recognize from Security on another portion of the network (at least on a topic that wasn't migrated) – AJ Henderson Jan 15 '13 at 18:12
  • ha! It's good to see you're here! – technology_is_overrated Jan 15 '13 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.