Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Any way to force the browser to prompt for a client certificate, even if another one was already installed?

At that apache level? At the browser level?

I'm totally cool with a solution that is browser-dependent because i'm only dealing with the major browsers.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Revoke the old cert.

Then HURL inbound port 80 traffic to port 443 (HTTPS) which should cause the browsers to download and accept the new cert.

If revocation isn't an option, then you might have to redirect traffic to another server with just the new cert installed.

share|improve this answer
    
Revoke the old cert - you mean through the browser right? because that's the step that's annoying. having to keep going in and manually changing it each time. easy to forget. would rather have a prompt pop up. –  Nicholas DiPiazza Jan 30 '13 at 15:12
    
No I mean revoke the cert in the cert store. That'll make it invalid from the server, and ALL clients/browsers will re-request a valid cert - at that point your new one is the only one available. invoke the cert store on the server thus: Run "MMC" file | Add/Remove Snap-ins Select Certificates Select Computer Certificates Select Local Computer Finish close the add wizard The "Personal" section of the cert store will show certificates on the server. –  George Erhard Jan 30 '13 at 16:41
    
The above is for a Windows Server, but on a *nix machine, you should be able to browse the cert store directly, and either revoke or delete the old cert. –  George Erhard Jan 30 '13 at 16:51
    
wow that's pretty solid advise. I'm giving it a go. –  Nicholas DiPiazza Jan 30 '13 at 19:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.