I currently have server SSL in place so that clients have a secure connection to my web server.
I am looking to implement client SSL certificates IN ADDITION TO regular username/password login, but I'm having a hard time understanding exactly what needs to happen.
- Should each user receive their own certificate?
- Should this be generated upon user account creation?
- Should a user receive a separate certificate for each device they use? (i.e. phone, tablet, pc)
- What should the fields in the certificates DN be?
- For each user certificate, should there be a corresponding private key, or a single key for all the certificates?
- How are these user certificates distributed? Is there an automated way to install them?
- Should they be stored on the server for download?