The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing.
Email, single sign on, web site auth, etc. Works great!
Why is nobody using SSL client certificates?
11–20 of 160 posts
Re: Why is nobody using SSL client certificates?
#12The key management tools are awful. People complain about the complexity of PGP but at least there it's one-click to export a key, look at the details of it, sign someone else's key etc. But yeah, it would be nice to use this tech rather than reinventing the wheel. The underlying implementation is sound.
The whole system, now close to 20 years old, needs a reboot. I know, that's easy for me to say. But it's showing its age, and could really benefit from a complete rethink.
Do you have specific criticisms? In cryptography, a system that has withstood scrutiny for that long is a rare and exceedingly valuable thing. By all means use it as the ugly foundations that you hide beneath the beautiful edifice on top, but throwing it away would be madness.
Re: Why is nobody using SSL client certificates?
#13I think this would need a total re-think before the masses could use.
I'd love to see browsers implement it by forcing people to store client certs on a USB-key or a phone by default. I think some kind of physical item that contains your keychain would be much more intuitive to many. Everyone is familiar with mechanical keys, they know not to leave them around, they know that they need them to unlock things and they know if they lose them they need to replace them.
Re: Why is nobody using SSL client certificates?
#14Correct me if I'm wrong, but unless they can be password protected (which defeats the object...) aren't they less secure than passwords in practice?
I have a password on my phone, because I don't want people with access to it to be able to login and look at my stuff. What's to stop my friend Joe Blogs coming over my house and being able to read my email because I have one of these things installed that allows for a one-click login?
Re: Why is nobody using SSL client certificates?
#15My suggestion for fixing the client cert problem is to task the browser with certificate generation upon profile creation. There are significant security implications of course, but sites aren't really incentivized to support client certificates.
If 50% of my traffic already tried offering me a client cert the decision to allow them would be an easy one to make.
Re: Why is nobody using SSL client certificates?
#16Try having two client certificates and seeing the browser UX for selecting which one to present to which site. You'll see why they aren't used.
Client certificates should be much more popular in backend applications, where they're straightforward to use, flexible, and fairly trustworthy. But they're not a good end-user technology.
Re: Why is nobody using SSL client certificates?
#17Yep -- too hard to setup. A really good browser enhancement would be 1-click client side certificate setup.
[deleted]
Re: Why is nobody using SSL client certificates?
#18In theory, it's a little simpler - at least for new keys...
See https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ke... and http://www.w3.org/TR/html5/forms.html#the-keygen-element
Re: Why is nobody using SSL client certificates?
#19I use it for StartSSL. It allows me to use SSL client cert auth for their OpenID instance.[0] I use it to log into StackOverflow and a few prominent sites. I like the idea of my cert provider being a trusted party for auth for other sites. However, trusting anyone other than himself in this post-PRISM era is probably a mistake.
Re: Why is nobody using SSL client certificates?
#20The whole DOD is using it, but they're on crypto smart cards, so many folks don't realize that's what they're doing. Email, single sign on, web site auth, etc. Works great!
I would love to hear more about this. I've been looking for a good sso solution that uses crypto cards.