In comparing different SSL certificates I see "Server-Client Authentication" listed as a benefit of a paid certificate over a free one. (see it here)

But what exactly is this added benefit that basic SSL does not already provide?

EDIT: This other link here does NOT answer this my question. In other words, if you search that other question for the term, "Server-Client Authentication", it's not found.

  • It seems this might be a product-specific term. You could probably just contact their sales team to ask.
    – dan
    Jan 16 '14 at 1:18
  • Yes, I'm starting to think it's just window dressing, not technology. Jan 16 '14 at 1:20
  • Companies do tend to come up with fancy sounding marketing terms - if you do a search on them and don't find anything, that's likely the case as SSL is a pretty standardized industry.
    – dan
    Jan 16 '14 at 1:28

Server program should have access to the server certificate, which contains the server's identity, private key and public key.

In the handshake process, the server will extract the server's public certificate and send it to the client site.

From the client side, the client program should be able to authenticate the server's identity .Server authentication seems to be always required to their site.


The conext sensitive help on the StartSSL website states:

Combined Server and Client Authentication support with SSL/TLS server certificates

This appears to be a feature related to requiring your users to have personal security certificates installed in their web browser. From http://webadmns.blogspot.com/:

If you enable client authentication, the server validates clients by checking for trusted certificate authority, Known as CA root certificates in the local key database. To enable client authentication, you need to use SSLClientAuth directive.

... The server requires a valid certificate from all clients and returns a 403 status code if no certificate is present.

A friend of mine started a company called CryoKey that lets you generate a personal certificate that gets installed in your web browser. This type of certificate would be the type used for both client and server authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.