I've been redirected here from SuperUser, I hope the question is appropriate.
I need to restrict usage of a certain site to a limited number of customers.
More than that, actually: I would like to allow access from a restricted number of physical devices (Win + Android).
This means I should generate "device locked" certificates.
What is the best way to generate and deploy such certificates?
- Solution should not be browser specific (if possible; IE, FFox and Chrome are minimum).
- Browser should combine certificate with some hardware fingerprint before trying to use.
- I do not care if certificate is invalidated by system upgrade (I am perfectly OK issuing a new one... and deleting the old).
- Checking should be done "server-side".
A SuperUser comment says:
There is no binding of a certificate to a hardware. If you want this you need to use certificates which are integrated into the hardware and cannot be extracted from there, i.e smartcards.
Smartcards are not a viable solution for me, but some kind of USB equivalent could be used, if necessary, provided devices are cheap enough (few USD/each).
Alternatively I could request browser to send some information and try to validate the Client for there (something akin to https://panopticlick.eff.org/ coupled with custom certificate). Would that work? If so: what would I need? Are there libs performing similar checks Server-Side?
I searched the suggested "Similar Questions" but I didn't find something resembling my problem.