Precisely, can I remove smart card from card reader once I successfully started a SSL/TLS session? Will website still 'see' my client certificate (public key) after I removed card from the reader and navigated on the website? Will I still be able to communicate with website in the same SSL/TLS session?
1 Answer
Precisely, can I remove smart card from card reader once I successfully started a SSL/TLS session?
Yes. I think that is the most likely scenario. The client cert is used to establish the initial connection and negotiate a SESSION KEY. This is the initial session negotiation. After that, you can theoretically RENEGOTIATE any time the server (and sometimes the client, too) feels like it. But that depends on the specific web app. However it would be out of the ordinary, and I don't think it's very likely.
But just try it yourself and/or ask the admins of the web app.
answered Nov 27, 2015 at 19:28
-
"But just try it yourself and/or ask the admins of the web app." - My problem is I don't have a card nor reader and don't know who to ask :-)– PolNov 27, 2015 at 20:01
-
1Note that the client itself may be programmed in such a way that the connection is severed whenever the card is made unavailable by the user (to protect the user from others to use the authenticated session). Nov 28, 2015 at 0:33
-
@MaartenBodewes: I was thinking about regular browsers. I don't think they get to do that. Nov 28, 2015 at 7:19
-
@StackzOfZtuff You may be right, although e.g. IE tends to rely on OS functionality, which - at least in principle - should be able to detect card removal. Nov 28, 2015 at 11:23
-
@MaartenBodewes: I'm no programmer, but this sounds like something that you'd need a plugins help for, though. (Flash, Java, ActiveX) And not something that has a regular HTML5 API. Nov 28, 2015 at 12:36