Is not just the UX of using the client certificate in the browser, there's also the problem in the server: maintaining a CRL (Certificate Revocation List), or u

Is not just the UX of using the client certificate in the browser, there's also the problem in the server: maintaining a CRL (Certificate Revocation List), or using OCSP (Online Certificate Status Protocol). I've been forced to use it in some scenarios as client and, although I found it a little bit confusing at first, it works; but my experience on the server... is just awful to implement.