Client certs are still a bit of a pain. There is already an IETF spec in the works, called Token Binding, on how to bind tokens to key pairs that clients mainta

Client certs are still a bit of a pain. There is already an IETF spec in the works, called Token Binding, on how to bind tokens to key pairs that clients maintain, and create on demand. https://github.com/TokenBinding/Internet-Drafts https://github.com/TokenBinding/Internet-Drafts http://www.browserauth.net/home http://www.browserauth.net/home It's already implemented in Chrome.