up vote 1 down vote favorite
share [g+] share [fb]

We have an internal website, served from behind HTTPS with client certificates.

Website users are non-technical persons, working remotely. They use Windows (XP, Vista, 7) and OS X (10.5, 10.6, 10.7). They use a variety of browsers, but we can limit the range to modern Chrome, FireFox and Safari (on OS X).

The problem is that it is a huge pain to set up access for a new user or replace a certificate. Since the users are working remotely, they have to install their SSL certificates themselves — with all the usual consequences. Diagnosing and fixing the issues that arise from that can take days.

I'm looking for a good troubleshooting guide for our sysadmin (the questions to ask users, the tools to gather diagnostics etc.) and maybe some advice on how to improve the whole workflow.

link|improve this question
75% accept rate
feedback

1 Answer

up vote 2 down vote accepted

I think you made a strategic mistake in using SSL client certificates. They're a great idea in theory, but in practice they're just not user-friendly enough to be able to deal with them on a mass-deployment scale.

My only suggestion would be to require users to allow remote access to the machines, and have the sysadmin remote in and do the necessary bits and pieces and test that it's all working.

link|improve this answer
What secure alternative would you suggest? – Alexander Gladysh Jul 29 '11 at 18:59
Questions go in questions, not comments, and that isn't a sufficiently specific question to be able to answer. – womble Jul 30 '11 at 0:24
Bah. That's exactly the reason I'm asking that in a comment. – Alexander Gladysh Jul 30 '11 at 14:06
If a question is too general to be properly answered in the unlimited space of an answer box, how can it be answered in 600 characters? – womble Jul 30 '11 at 14:28
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.