Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an internal website, served from behind HTTPS with client certificates.

Website users are non-technical persons, working remotely. They use Windows (XP, Vista, 7) and OS X (10.5, 10.6, 10.7). They use a variety of browsers, but we can limit the range to modern Chrome, FireFox and Safari (on OS X).

The problem is that it is a huge pain to set up access for a new user or replace a certificate. Since the users are working remotely, they have to install their SSL certificates themselves — with all the usual consequences. Diagnosing and fixing the issues that arise from that can take days.

I'm looking for a good troubleshooting guide for our sysadmin (the questions to ask users, the tools to gather diagnostics etc.) and maybe some advice on how to improve the whole workflow.

share|improve this question

closed as off-topic by Jenny D, kasperd, womble Oct 15 '15 at 1:20

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

I think you made a strategic mistake in using SSL client certificates. They're a great idea in theory, but in practice they're just not user-friendly enough to be able to deal with them on a mass-deployment scale.

My only suggestion would be to require users to allow remote access to the machines, and have the sysadmin remote in and do the necessary bits and pieces and test that it's all working.

share|improve this answer
What secure alternative would you suggest? – Alexander Gladysh Jul 29 '11 at 18:59
Questions go in questions, not comments, and that isn't a sufficiently specific question to be able to answer. – womble Jul 30 '11 at 0:24
Bah. That's exactly the reason I'm asking that in a comment. – Alexander Gladysh Jul 30 '11 at 14:06
If a question is too general to be properly answered in the unlimited space of an answer box, how can it be answered in 600 characters? – womble Jul 30 '11 at 14:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.