I have the following situation:

  1. One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password;
  2. When the user is logged he can make anything in this site.

My objective is to automate this process using an PHP web application, for example.

The main question is: how to use this USB token certificate to log-in on the server? Any suggestion?


A USB token is usually a mean to precisely ensure that the user accesses the website in person. So this goes quite against any form of automation.

Theoretically you may leave the USB token connected for the use of the automated system, but that would defeat all what the USB token authentication is for (unless you consider it as a cheap HSM alternative, it would make sense but would be a complete different security schema).

Most probably you need to add a specific token-less authentication for your automated application. This usually go through a supplementary access with lower privileges than the actual user, for instance limited to (some) web API accesses and no web interface access.


If your browser supports using certificates from the token, you can setup HTTPS client authentication on the server and your PHP script can just read the user name from environment variables.

Successful deployment of such a setup involves a lot of infrastructure (typically IIS/Apache, Windows Domain and certificate service), user training and support though.

Normally this is implemented using PKI smart cards (which a lot of these USB tokens emulate) that is also used to log the user into the computer. The user will have a strong incentive to remove the card/token when leaving the computer so to protect files stored in the account. Also, Windows logo-compliant smart cards automatically locks itself when the user locks the computer, so the user must enter the PIN again to unlock the card and the computer. This setup partially solves the issues raised by @WhiteWinterWolf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.