Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

If I wanted clients to identify themselves how can I issue them client certificates? Does it matter whether they are using Windows or Linux or whether it is a mobile device? What information do I need to provide to Certificate Authorities?

share|improve this question
This is an awfully vague question. What are you actually trying to do? – David Schwartz Nov 7 '11 at 21:59
@David Schwartz - I wish anyone attempting to access a web server hosting a website that already utilizes SSL to identify themselves regardless of whether they are using a browser or an app. I imagined this would be achieved by issuing client certificates. Seeing that SSL certificate on the web server was issues by a CA, what do I need to do i.e. what information do I need to collect and provide to the CA to issue client certificates? – PeanutsMonkey Nov 7 '11 at 22:03

1 Answer

up vote 3 down vote accepted

It depends on the CA you choose. There are CAs that will happily issue client certificates just by validating an email address. Generally, certificates are issued for signing emails, encrypting emails, and identifying a client. In all three cases, you basically just want to associate a key with a person identified by their email address.

StartCom's free CA doesn't really mention it anywhere, but they offer free client certificates. The process is precisely the same as the process to get a free SSL certificate, and you can use the same account for both. WoSign has a similar system, as do many other CAs.

If you just want a validated email address for your own use, you don't need a CA at all. Just validate the email address with a click-through email and issue the certificate yourself. Obviously, you'll be the only entity to accept that certificate as proving anything, but if that's all you need, so be it. StartCom does this too. Log into their system and watch it generate a certificate for you and then use it to log you in.

share|improve this answer
So would it differ if I also required client certificates for apps? For example the company I work for has developed an IPhone app and they would like only users with client certificates to access information from the server. Are email addresses the only form of identifiers? – PeanutsMonkey Nov 8 '11 at 0:15
It's hard to say without understanding the requirements exactly. What do they mean by "users with client certificates" exactly? What is the requirement they are trying to meet? If the requirement is simply to prove that it's the same user each time, any certificate will do. If the requirement is a provable human identity, it can be expensive and tedious on the users. – David Schwartz Nov 8 '11 at 0:38
The requirement is that one that it is the same user. Not sure what you mean by any certificate will do? The second requirement is to prove human identity. – PeanutsMonkey Nov 8 '11 at 1:07
If the requirement is to prove human identity, then you should make a list of CAs that validate human identity to your satisfaction and require your users to get a certificate from those CAs. This will significantly cut down on the number of users you'll get. – David Schwartz Nov 8 '11 at 1:09
Can you give me an example of CAs that validate human identity? Also assuming we want to go with just making sure it is the same user, do we simply contact any CA and provide them with an email address? – PeanutsMonkey Nov 8 '11 at 1:18
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.