4

Not sure if this belongs here or at serverfault...

I've seen websites where, to login to the website, requires a digital certificate to be installed for the user logging in. As far as I can tell, this certificate is in addition to the website using an SSL certificate (https)

I'm just looking to be pointed in the right direction on how to code for this (apache / php hopefully), who issues these certificates (must it be a trusted var or can I ?) or even what to search for via google.

-Mario

|improve this question
2

You want an SSL client certificate. The server certificate proves who they are, the client certificate proves who you are to them.

Here's some apache documentation on how to configure your site: http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html#certauthenticate

This blog post is interesting: http://www.gnegg.ch/2008/05/why-is-nobody-using-ssl-client-certificates/

|improve this answer
  • I guess I should have explained a bit better. I've seen these certificates used on banking websites and payroll websites. Their issued to the user logging into the website; upon login, your challenged for it (if its not already installed) - its not a certificate for the website as a whole, but for the user logging into the website. – lsiunsuex Jun 30 '11 at 13:49
  • He's referring to software tokens as a replacement for user/password authentication. – Nick Jun 30 '11 at 14:01
  • I've updated my answer, you were right, this really is in addition to a server certificate. – paulmorriss Jun 30 '11 at 14:04
  • php-security.net/archives/… - i found this also; this is a 509; which took me to this - us2.php.net/manual/en/ref.openssl.php - Thanks for your help guys - much appreciated. – lsiunsuex Jun 30 '11 at 14:18
1

Consider two-factor authentication instead

I'd recommend a two-factor authentication (2FA) system such as those from DuoSecurity, RSA, AlterEgo, Wikid Systems, and Signify instead of a client-side SSL certificate, because it requires little-to-no technical set up or education for your site's visitors (and it's more secure than relying on an SSL client certificate alone).

Instead of having to download and install a certificate, visitors can authenticate themselves by receiving a phone call or text message, by visiting a web page, or opening an app.

Client-side SSL certificates

If you've seen what the above companies have to offer and still wish to use client-side SSL certificates, CAcert.org offers this example of how they use mod-ssl under Apache with PHP to authenticate visitors based on client-side certificates:

Apache config

<VirtualHost 127.0.0.1:443>
SSLEngine on
SSLVerifyClient require
SSLVerifyDepth 2
SSLCACertificateFile /etc/ssl/cacert.crt
SSLCertificateFile /etc/ssl/certs/cacert.crt
SSLCertificateKeyFile /etc/ssl/private/cacert.pem
SSLOptions +StdEnvVars

ServerName secure.cacert.org
DocumentRoot /www
</VirtualHost>

PHP

if($_SERVER['HTTP_HOST'] == "secure.cacert.org") {
    $query = "select * from `users` where `email`='$_SERVER[SSL_CLIENT_S_DN_Email]'";
    $res = mysql_query($query);
    if(mysql_num_rows($res) > 0) {
        $_SESSION['profile']['loggedin'] = 1;
        header("location: https://secure.cacert.org/account.php");
        exit;
    }
}
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.