3 ms·

Yes, and browser vendors have refused to enhance support for this. To be fair though, client certificates have some obvious downsides, before all that you only

Yes, and browser vendors have refused to enhance support for this. To be fair though, client certificates have some obvious downsides, before all that you only have them on the device where they have been created. Since most people use several devices (desktop/notebook/tablet/phone) throughout the day, you require some way to keep them in sync. Cloud services could solve this, but tend to be vendor-specific, and doing it by hand via sneakernet is painful. Then this same problem occurs all over again if a certificate is leaked, for example due to device theft, and the cert needs to be revoked and replaced. In summary, while browser and mobile OS vendors could cooperate to improve the situation with client certificates, as of now, there appears to be no interest from any party to do so, and unless it happens, it is not worth it to use client certificates at all.

nybble41 6y ago
> Since most people use several devices (desktop/notebook/tablet/phone) throughout the day, you require some way to keep them in sync. The obvious solution, rather than syncing the certificates, would be to allow more than one client certificate per account. Each device would have its own certificate. If one device is compromised you need only revoke that particular certificate; other devices could still access the account. To avoid the need to manually register multiple certificates for each account you could cross-sign the per-device certificates; i.e. if key A is registered, and key B is signed by key A, then key B can also be used to sign in, perhaps with a warning sent to the owner of the account about a login from a new device.