What is SSL Client Certificate Authentication and How Does It Work?

1 Star2 Stars3 Stars4 Stars5 Stars (3 votes, average: 4.33 out of 5)
Loading...

Did you know that SSL can be used for both client authentication as well as server authentication? And what is SSL client certificate authentication to begin with?

When most people refer to SSL certificates and the authentication they provide, it’s done in the context of server SSL certificates — not client authentication. This is an important to note because the vast majority of SSL certificates that are used are server certificates. When a client arrives at a website, the server presents its certificate and the client performs an authentication to verify the identity of the certificate’s owner.

SSL/TLS can do a lot more, though. It can also be used to authenticate the client (i.e. your visitor’s web browser), provided it has its own certificate.

Purchase a UCC SSL Certificate and Save Up to 89%

We offer the best discount on all types of UCC SSL Certificates. Our offerings include Comodo UCC or Unified Communications SSL Certificates, which start for as little as $18.02 per year.

Shop UCC SSL Certificates

SSL Server Certificate Authentication vs SSL Client Certificate Authentication

As we just mentioned, before a secure connection occurs, an SSL/TLS handshake must be performed to handle authentication and to negotiate the protocol version and ciphers that will be used once the connection begins. Traditionally, when the client arrives and the server presents its certificate, the client is the one handling authentication functions.

This is done with a series of checks to verify that the certificate is:

  • Trusted (digital signature),
  • Valid (time-stamp, not-before/after dates),
  • Not revoked (OCSP or CRL), and
  • Properly logged (CT logs).

When a client SSL certificate is present, though, both sides perform the authentication steps. When the server presents its certificate, the client responds with its own. Then, both the client and server authenticate the certificate before the handshake can conclude. It’s an additional step, but it happens behind the scenes and typically doesn’t add much latency.

The Benefit of Authentication Using HTTPS Client Certificates

The advantage of using SSL client certificate authentication is that now two-factor authentication (2FA) can be performed without an SMS code or an email being sent. The client SSL certificate is installed on any device that’s meant to connect with a given website or server, when the user navigates to that end point the authentication of their client SSL certificate serves as the “something you have” portion of the two-factor authentication, allowing the user to simply enter a password and continue on their way.

Now, F2A is being practiced without annoying the employee or end user. Considering that inconvenience is one of the most widely cited reasons for not following security best practices, cutting out any inconvenience while still maintaining the security provided by two-factor authentication is a huge plus.

It’s also the most inexpensive way to accomplish 2FA. Not that we’re biased or anything.

Shop for Web Server Certificates

We offer the cheapest SSL certificates from trusted SSL brands or Certificate Authorities (CAs). Get your web server certificate and save up to 88%, depending on the certificate and brand you choose.

Buy Sectigo SSL Certificates for as Little as $5.45