Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

In comparing different SSL certificates I see "Server-Client Authentication" listed as a benefit of a paid certificate over a free one. (see it here)

But what exactly is this added benefit that basic SSL does not already provide?

EDIT: This other link here does NOT answer this my question. In other words, if you search that other question for the term, "Server-Client Authentication", it's not found.

share|improve this question
    
It seems this might be a product-specific term. You could probably just contact their sales team to ask. –  dan Jan 16 at 1:18
    
Yes, I'm starting to think it's just window dressing, not technology. –  Eliptical view Jan 16 at 1:20
    
Companies do tend to come up with fancy sounding marketing terms - if you do a search on them and don't find anything, that's likely the case as SSL is a pretty standardized industry. –  dan Jan 16 at 1:28
add comment

2 Answers 2

Server program should have access to the server certificate, which contains the server's identity, private key and public key.

In the handshake process, the server will extract the server's public certificate and send it to the client site.

From the client side, the client program should be able to authenticate the server's identity .Server authentication seems to be always required to their site.

share|improve this answer
add comment

The conext sensitive help on the StartSSL website states:

Combined Server and Client Authentication support with SSL/TLS server certificates

This appears to be a feature related to requiring your users to have personal security certificates installed in their web browser. From http://webadmns.blogspot.com/:

If you enable client authentication, the server validates clients by checking for trusted certificate authority, Known as CA root certificates in the local key database. To enable client authentication, you need to use SSLClientAuth directive.

... The server requires a valid certificate from all clients and returns a 403 status code if no certificate is present.

A friend of mine started a company called CryoKey that lets you generate a personal certificate that gets installed in your web browser. This type of certificate would be the type used for both client and server authentication.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.