Hacker News Reader

Comment by tptacek | Hacker News Reader

Try having two client certificates and seeing the browser UX for selecting which one to present to which site. You'll see why they aren't used.

Client certificates should be much more popular in backend applications, where they're straightforward to use, flexible, and fairly trustworthy. But they're not a good end-user technology.

View on HN

I agree that for machine to machine communication client certificates work well. Especially if you implement your own CA so you don't worry about the public infrastructure.

If you're writing your own code for both sides, an approach that I've seen work just as well is to keep whitelists of certificate fingerprints.

Speaking of backend applications, Puppet uses client certificates to authenticate machines that are being administrated by a Puppet server. I used to work on that code - none of us would have ever called it "straightforward". The library support for client certs is underdeveloped and poorly documented - probably because so few people are using client certs in production.

I feel like I've written a fair bit of client certificate code in Ruby and haven't had much of a problem. Where did you run into problems?

I wish I could remember the specific issues. It's been a few years now, and all I can recall about it was that feeling that we had a couple of experts in the open source community who could make it work, and the rest of us just shrugged and accepted their patches. I know that the bugs tended to cluster around the Certificate Revocation List, but I can't remember how they manifested.

Not too bad on the Mac: prompts you to pick one when required. If you use more than one cert on a single site then you need to go into Keychain Access to delete the favoured cert for site thingy to make it prompt you each time. Move client certs to their own keychain to password protect them.

Agreed if you configure your HTTPS server to accept certificates from any issuer. But if you restrict it to a smaller list of CAs, users are only prompted to choose among their certificates matching those CAs.

It's possible to self sign client certificates, right? If so, you could just limit the list to your own.

Relevant classic: http://www.gaudior.net/alma/johnny.pdf

To your mind, is this more a matter of the particular UI that currently exists, or are the UX issues more fundamental to the technology?

You can imagine a UX that would abstract certificates and their generation into a notion of accounts or personas, but the binding of those accounts to actual websites would be tricky and might involve new protocol, which is something you don't want to be doing with TLS certificates.

Reply on news.ycombinator.com