I used SSL client certificates with a Lotus system from 2000 to ~2011. They're still in use today, I just no longer work there. It's pretty easy maintenance on

I used SSL client certificates with a Lotus system from 2000 to ~2011. They're still in use today, I just no longer work there. It's pretty easy maintenance once you set up systems for account managers to generate and issue new certificates for people. Then again, this was small time. Few thousand active users. Niche bio/pharma web application. Large scale it could very well be a bitch and/or unnecessary at this point in time. The system was designed/created between '96 and '98 and has used certificates the entire time.