4 ms·
This is extremely simple, actually. Just set your web server with SSL mutual authentication and require the client certificate to be an A3 (smart card or usb t
by eduardordm 14y ago
This is extremely simple, actually.
Just set your web server with SSL mutual authentication and require the client certificate to be an A3 (smart card or usb token). You can even restrict the CA or roll your own.
This is not rare, in fact, some countries require all companies to have at least one A3 certificate. Using A3 certificates for authentication is inherently a two-factor authentication, it can even be three if you require password for the actual service.
- beagle3 14y agoMy question is on a different level completely: Where do you actually get those tokens, at a reasonable price ($20-$40 each, not the $100-$500 of RSA and friends) in the US? If I want my users to present certificates like that, I expect them to be able to purchase them themselves. Once they have the key, the exact procedure is less important (The app I'm working on is not, in fact, a webapp, so I can do whatever I please. In fact, I need the user to sign documents with their certificate, not just present it).