Not sure if this belongs here or at serverfault...

I've seen websites where, to login to the website, requires a digital certificate to be installed for the user logging in. As far as I can tell, this certificate is in addition to the website using an SSL certificate (https)

I'm just looking to be pointed in the right direction on how to code for this (apache / php hopefully), who issues these certificates (must it be a trusted var or can I ?) or even what to search for via google.


2 Answers 2


You want an SSL client certificate. The server certificate proves who they are, the client certificate proves who you are to them.

Here's some apache documentation on how to configure your site: http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html#certauthenticate

This blog post is interesting: http://www.gnegg.ch/2008/05/why-is-nobody-using-ssl-client-certificates/

  • I guess I should have explained a bit better. I've seen these certificates used on banking websites and payroll websites. Their issued to the user logging into the website; upon login, your challenged for it (if its not already installed) - its not a certificate for the website as a whole, but for the user logging into the website.
    – lsiunsuex
    Jun 30, 2011 at 13:49
  • He's referring to software tokens as a replacement for user/password authentication.
    – Nick
    Jun 30, 2011 at 14:01
  • I've updated my answer, you were right, this really is in addition to a server certificate. Jun 30, 2011 at 14:04
  • php-security.net/archives/… - i found this also; this is a 509; which took me to this - us2.php.net/manual/en/ref.openssl.php - Thanks for your help guys - much appreciated.
    – lsiunsuex
    Jun 30, 2011 at 14:18

Consider two-factor authentication instead

I'd recommend a two-factor authentication (2FA) system such as those from DuoSecurity, RSA, AlterEgo, Wikid Systems, and Signify instead of a client-side SSL certificate, because it requires little-to-no technical set up or education for your site's visitors (and it's more secure than relying on an SSL client certificate alone).

Instead of having to download and install a certificate, visitors can authenticate themselves by receiving a phone call or text message, by visiting a web page, or opening an app.

Client-side SSL certificates

If you've seen what the above companies have to offer and still wish to use client-side SSL certificates, CAcert.org offers this example of how they use mod-ssl under Apache with PHP to authenticate visitors based on client-side certificates:

Apache config

SSLEngine on
SSLVerifyClient require
SSLVerifyDepth 2
SSLCACertificateFile /etc/ssl/cacert.crt
SSLCertificateFile /etc/ssl/certs/cacert.crt
SSLCertificateKeyFile /etc/ssl/private/cacert.pem
SSLOptions +StdEnvVars

ServerName secure.cacert.org
DocumentRoot /www


if($_SERVER['HTTP_HOST'] == "secure.cacert.org") {
    $query = "select * from `users` where `email`='$_SERVER[SSL_CLIENT_S_DN_Email]'";
    $res = mysql_query($query);
    if(mysql_num_rows($res) > 0) {
        $_SESSION['profile']['loggedin'] = 1;
        header("location: https://secure.cacert.org/account.php");

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.