Subject: [http-auth] Fwd: [TLS] HTTPS client-certificate-authentication in browsers

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 25 Jul 2011 09:36:03 -0400

Might be of interest here...

-------- Original Message --------
Subject: [TLS] HTTPS client-certificate-authentication in browsers
Date: Mon, 25 Jul 2011 14:06:59 +0200
From: Anders Rundgren <[email-masked]>
To: [email-masked]

Hi Guys,
I don't really know who "owns" this question but presumably you do...

HTTPS client-certificate-authentication in browsers
===================================================
I don't believe that TLS CCA (Client Certificate Authentication) in the
form of HTTPS as implemented in current browsers has much of a future.

In fact, quite a bunch of the entities in the EU working with consumer PKI
have replaced HTTPS CCA with an application level scheme which wasn't such
a big deal since they anyway were forced writing a browser PKI client more
or less from scratch since the ones shipped with browsers doesn't support
PKI as defined by banks and government (like mandatory PIN codes also
for on-line enrolled keys).

That the TLS CCA protocol doesn't even support "Logout" haven't made
it a logical choice for web developers either.  Well, there are some
workarounds but they are by no means straightforward, supported
out-of-the-box by server authentication schemes, and are (of course)
entirely undocumented.

The button "Clear SSL state" in MSIE is an indication how horribly bad it
can go when security experts design systems for "people".

There's no way you can hide the fact that TLS CCA is only truly useful
securing tunnels between "boxes".

Anders

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Yoav Nir <[email-masked]>
Date: Mon, 25 Jul 2011 17:01:51 +0300

I'm pretty sure that if client certificates worked for HTTPS, we would not have an HTTP-AUTH initiative.

But the biggest thing working against certificates is that they identify a device, not a user. If I have several devices then I either have to have multiple copies of my cert and private key, or several different certificates, one for each device, or an n+1-th device (such as a USB token) that contains the private key and can be connected to any browser, and there's no technology now that would work with all browsers.

It's little wonder that all the big services prefer to use passwords.

Yoav