3 ms·

I have a bit of a history with SSL client certs; I'm the reason the Windows Azure management APIs all use SSL client certs for auth/security. Looking back, I th

by sriramk 15y ago

I have a bit of a history with SSL client certs; I'm the reason the Windows Azure management APIs all use SSL client certs for auth/security. Looking back, I think it's a bad idea. - Most developers don't understand them. - Library support for them is wonky - we've run into issues with curl, the PKI infrastructure in Windows and weird bugs up and down the stack - There is a lot of complexity around cert management - how do developers move it around machines, share with their team, etc. We had a lot of good reasons for using it and a lot of scenarios were made much easier still. But if I had to go back and have a do over, I would probably use OAuthv2 (which didn't exist then :) ).

wmf 15y ago
Weren't InfoCards like client certs with better UX? What happened there?
- sriramk 15y ago
  Nobody adopted them (my opinion, not sure what the official take is). Don't think anybody understood them either.
  - ComputerGuru 15y ago
    That was one of the features I was most excited about in Windows Vista, and I was really sad that MS did not push them in way, shape, or form; or even make an effort to use them on their own web properties. I think they could have caught on at least as well as BrowserID will.