4 ms·
I really would love to use client-side certificates everywhere. It's just too much of a pain in the ass to do so. Off the top of my head: - Generating client-
by jf 17y ago
I really would love to use client-side certificates everywhere. It's just too much of a pain in the ass to do so.
Off the top of my head:
- Generating client-side certificates is expensive or a pain in the ass.
- Every browser deals with client-side certificates differently. Some give scary warnings, etc.
- Firefox and IE can generate keys locally and send a CSR to you, but they do it differently. Safari can't even generate keys locally.
I really wish that the state of client-side certificates was better than it is. I look forward to the day when I can easily build services that use client-side certificates.
- washingtondc 17y agoIt's not hard to generate a certificate request. While Firefox and IE may use different routines to do a local key generation, it's certainly not difficult. The scary warnings you're talking about come up if you're connecting to an "untrusted" site - who's SSL server certificate isn't signed by a known, trusted root CA. It's certainly the best solution to this problem.
- jf 17y agoYes, generating a certificate request isn't hard. Maintaining a CA is annoying at best. Do you have a link to a site that describes how to do local key generation in Firefox and IE? Maybe I was just looking in the wrong places? The scary warnings I was talking about are not the "untrusted" site warnings, they are the warnings you get after the remote SSL server times out. I guess this can happen after a few hours, depending on the server. Yes, it's the best solution to this problem, but it's still a major pain in the ass.