: Certificate for website login Not sure if this belongs here or at serverfault... I've seen websites where, to login to the website, requires a digital certificate to be installed for the user

@Jessie594

Consider two-factor authentication instead

I'd recommend a two-factor authentication (2FA) system such as those from DuoSecurity, RSA, AlterEgo, Wikid Systems, and Signify instead of a client-side SSL certificate, because it requires little-to-no technical set up or education for your site's visitors (and it's more secure than relying on an SSL client certificate alone).

Instead of having to download and install a certificate, visitors can authenticate themselves by receiving a phone call or text message, by visiting a web page, or opening an app.

Client-side SSL certificates

If you've seen what the above companies have to offer and still wish to use client-side SSL certificates, CAcert.org offers this example of how they use mod-ssl under Apache with PHP to authenticate visitors based on client-side certificates:

Apache config

<VirtualHost 127.0.0.1:443>
SSLEngine on
SSLVerifyClient require
SSLVerifyDepth 2
SSLCACertificateFile /etc/ssl/cacert.crt
SSLCertificateFile /etc/ssl/certs/cacert.crt
SSLCertificateKeyFile /etc/ssl/private/cacert.pem
SSLOptions +StdEnvVars

ServerName secure.cacert.org
DocumentRoot /www
</VirtualHost>


PHP

if($_SERVER['HTTP_HOST'] == "secure.cacert.org") {
$query = "select * from `users` where `email`='$_SERVER[SSL_CLIENT_S_DN_Email]'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0) {
$_SESSION['profile']['loggedin'] = 1;
header("location: secure.cacert.org/account.php );
exit;
}
}

Vote Up Vote Down

@Sue5673885

You want an SSL client certificate. The server certificate proves who they are, the client certificate proves who you are to them.

Here's some apache documentation on how to configure your site: httpd.apache.org/docs/2.0/ssl/ssl_howto.html#certauthenticate
This blog post is interesting: www.gnegg.ch/2008/05/why-is-nobody-using-ssl-client-certificates/

Vote Up Vote Down