3 ms·
In my 5 years as a UNIX Sysadmin I've set up SSL/TLS hundreds of times to protect web, email, and database communications, and not once have I ever been compell
by spudlyo 17y ago
In my 5 years as a UNIX Sysadmin I've set up SSL/TLS hundreds of times to protect web, email, and database communications, and not once have I ever been compelled to use client side certificates for authentication.
- antonovka 17y agoThey're a useful alternative/addition to Kerberos infrastructure, especially with PKCS#11 smart cards. I think that x509 client auth is probably underused due to the lack of good, free implementations of CA software to manage those certificates.
- tptacek 17y agoI strongly agree. Client cert auth is also harder to screw up than most of the alternatives, and, let's face it, the alternatives are almost always "shared passwords stored in configuration files".