Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any benefits for certificate based authentication over the other types of authenitication? When it is common to use it? If the certs are stolen everyone that have them cat authenticate to the system. Is this true?


share|improve this question
up vote 2 down vote accepted

The problems with passwords are that they are typically reused and easy to guess, so they are easy to compromise and one compromise often leads to multiple compromises. In a simplistic sense, a private key is just like a very long, very difficult to guess password, which makes brute forcing harder.

If the key is stolen, it's the same as a password being stolen and the same considerations need to be in place (is it used elsewhere?). If the certificate is stolen, in theory other keys could have been generated so yes, you need to re-issue every key associated with it. Typically though, if this happens, you've got bigger issues (how did this happen in the first place?).

See here for more discussion of the pros/cons.

share|improve this answer
This is a bit over-simplified. One of the most significant benefits of keys over passwords is that the private key is never sent between the servers (or ideally never exists in more than one place), making it much less likely to be exposed or stolen. (A malicious server or man in the middle can't steal the private key) – Slartibartfast Nov 10 '10 at 3:15
Good point, although a man in the middle can still cause problems, and for SSH (which I believe he's talking about), the password would not be send in plaintext. – James L Nov 10 '10 at 11:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.