I'm building a webapp and for the first time I need to look in to security, because some actions should only be done by registered users.

of course these parts of the app operate trough https (actually the whole app does), but for now there are only server-side certificates involved (eg the client knows the server is really the server).

to make security as simple as possible I would like to start using client-side certificates as well (so that the server knowns the connected client is really the client).

I'm a bit at a loss, though, on how to hand out/sign client-certificates. Is it okay for this to be done over https (server-certificate) behind a normal HMAC-like login scheme. Eg the user logs in and receives/is able to sign a certificate.

I'm using php as a backend and I'm looking into the html5 <keygen> tag, although this seems pretty insecure (uses md5).

Ideally I would like to be able to hand out and install client certificates almost unnoticed and refresh them every now and then (eg they expire every week).

The webapp doesn't require extreme security at all, but it runs from a personal web server which I would like to keep uninfested. Plus doing security at transport level always seemed more safe to me, and it keeps the security aspect of the app out of the real app code.

is all the above an acceptable approach? If not, why? if so, what are some easy ways to implement it.

note: my knowledge about webapps is scarce (that's why I'm building one, so I can learn) and my knowledge about security, its protocols and best practices even scarcer. In fact I have not even got a full understanding of how SSL works (I'm looking into that!) so please be gentle.


Client certificates won't be unnoticed by users, they usually involve some interaction at least (providing passphrases, allowing certificates to be sent). Installing new certificates will certainly require user involvement, so changing them every week is not feasible. You'll need to expect your users to understand what client certificates are and how to use them.

Furthermore, providing the certificates in-band means that they are only as secure as the security which protects the certificate generation and installation, and so one must question the point of adding certificates.

I'm not saying that you must throw out client certificates as an option (I'd love to see more prevalent use of them), just that you must assess whether they actually add security and whether the added security is worth the effort (out-of-band certificate distribution, user education and effort, etc.).

| improve this answer | |
  • I see. so renewing the certificates is a no-go, but perhaps it is also superflous? If the signing of the client-certificate happens over a https (server-certificate) connection behind a safe login mechanism (such as described here), would you say it is safe? I do not even supply a register option (poeple need to email me to register). – romeovs Feb 9 '13 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.