1

We have an internal website, served from behind HTTPS with client certificates.

Website users are non-technical persons, working remotely. They use Windows (XP, Vista, 7) and OS X (10.5, 10.6, 10.7). They use a variety of browsers, but we can limit the range to modern Chrome, FireFox and Safari (on OS X).

The problem is that it is a huge pain to set up access for a new user or replace a certificate. Since the users are working remotely, they have to install their SSL certificates themselves — with all the usual consequences. Diagnosing and fixing the issues that arise from that can take days.

I'm looking for a good troubleshooting guide for our sysadmin (the questions to ask users, the tools to gather diagnostics etc.) and maybe some advice on how to improve the whole workflow.

Improve this question

1 Answer 1

Reset to default
2

I think you made a strategic mistake in using SSL client certificates. They're a great idea in theory, but in practice they're just not user-friendly enough to be able to deal with them on a mass-deployment scale.

My only suggestion would be to require users to allow remote access to the machines, and have the sysadmin remote in and do the necessary bits and pieces and test that it's all working.

Improve this answer
4
  • What secure alternative would you suggest?
    – Alexander Gladysh
    Jul 29, 2011 at 18:59
  • Questions go in questions, not comments, and that isn't a sufficiently specific question to be able to answer.
    – womble ♦
    Jul 30, 2011 at 0:24
  • Bah. That's exactly the reason I'm asking that in a comment.
    – Alexander Gladysh
    Jul 30, 2011 at 14:06
  • If a question is too general to be properly answered in the unlimited space of an answer box, how can it be answered in 600 characters?
    – womble ♦
    Jul 30, 2011 at 14:28

Not the answer you're looking for? Browse other questions tagged .