3 ms·
How would you do the signing part though? Given that most CA don't do client certificate at all, nor it issue certificates with signing flags. Even if CA does
by sirn 6y ago
How would you do the signing part though? Given that most CA don't do client certificate at all, nor it issue certificates with signing flags.
Even if CA does sign client certificate, and website is expected to store its public key, it expose some privacy concerns since a public key is now Personally Identifiable. If a website must provide its own self-signed CA and require user to provide a CSR when registering for an account, then it becomes a huge overhead for both website and user to just login.
I work with enterprise and the requirement usually requires client certificate. I never had a good experience setting it up even with a limited number of parties.
- snuxoll 6y agoYou don’t need a public CA to do client certificate authentication. Hell, your computer doesn’t even need to trust the CA that signed the key - it’s the server on the other end that cares about that. This is precisely how WebAuthN works - but we figured out that we actually don’t need to go through the headache of getting CAs and signing involved at all. Just store a public key attached to a user after they’ve signed in via traditional means and let the browser/security token manage the keys.