(June 2020) I like client certificates, for all the reasons stated in the article. I have recently used them to authenticate API/RPC access for some IoT-ish de

(June 2020) I like client certificates, for all the reasons stated in the article. I have recently used them to authenticate API/RPC access for some IoT-ish devices. They work great. Setting up nginx to proxy things through to the backend Go API server was a bit uncomfortable, however. Getting the exact right incantation of `ssl_verify_client`, `map $ssl_client_verify ...` and `$ssl_client_escaped_cert` to achieve the desired effect is nowhere near as straightforward as it should be. Then on the backend, you have to be very mindful of what nginx has and hasn't done with respect to verification of the proxied client certificate. If you are not well-versed in mutual TLS, then I can easily see how this could go horribly wrong. Drew argues that OAuth is often implemented poorly. I agree, but I don't think that client certificates are less prone to implementation problems.