up vote 0 down vote favorite
share [g+] share [fb]

I am having a hard time understanding client side and server side certificates, where they are used, what they do, etc. I would appreciate some real world examples of where each of them are used.

link|improve this question
91% accept rate
feedback

1 Answer

up vote 2 down vote accepted

A server-side cert is used to authenticate and identify the server to the client, as well as to encrypt the connection. This allows the client to have certain assurances when connecting to and communicating with the server. Sites that require security such as banks, etc. use them.

A client-side cert is used to authenticate the client to the server. In this way the server can be certain of who is connecting to the server in much the same way as with a username/password pair, but usually without requiring interaction with the user. They are used with services where the client must be identified but there may not necessarily be someone to enter a username and password, or such is not desired.

link|improve this answer
Thanks. Are client-side certificates issued in the same manner server side certificates are? – PeanutsMonkey Nov 2 '11 at 2:15
They're usually issued by the organization that runs the server. – Ignacio Vazquez-Abrams Nov 2 '11 at 2:16
When you say issued by the organization that runs the server I assume you mean when an organization applies for a certificate from the likes of Thawte, etc. When you say the client is expected to import them how would this occur? For example I wish a client to authenticate themselves with a website, device, etc how would I issue a SSL certificate for them to import? – PeanutsMonkey Nov 2 '11 at 2:19
I'm not certain of all the details; I've never actually had to generate or issue them myself. – Ignacio Vazquez-Abrams Nov 2 '11 at 2:20
In order to issue a certificate, you need a certificate authority. This would be trusted by the web server, so any unrevoked certificate presented by a user to the website would be accepted as sufficient authentication. It is probably worth taking this to chat. – Paul Nov 2 '11 at 2:22
show 3 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.