What I'm trying to do is implement client-certificate authentication on my website (running on Apache).

From this question I understand that it's not possible to generate a client certificate myself based on a signed certificate (published by for instance Comodo).

My question is; For any website on for instance Apache, can I use a self-signed CA with which I verify my users (by them importing a client-certificate) and at the same time use a signed certificate so that 'the url bar' goes green?

Thanks a lot!

1 Answer 1


The certificate used to authenticate the server and the client do not have to be issued by the same entity. It is totally possible for you to set the web-server up with a certificate you bought and in the meantime create your own Public Key-Infrastructure to handle client certificates.

The authentication process is not mutual, so this situation is possible and yet remains secure thanks to asymmetric cryptography and proper trust chain.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .