I have a site that is protected with a user name/password login. For users that want to enter a certain area of the site, there is (legacy) code that looks for a client certificate and if the email in the cert matches the email associated with the login, then they can access this (extra) protected section.
Some questions about that approach:
- Can we continue to accept certs as long as they are from a trusted
- What prevents malware from stealing the client cert from a user's machine and placing it on another, compromised machine and using it from there?
- The way it stands now, as long as the cert comes from a system standard or commonly accepted CA, it is accepted. Should we change the logic to issuing the client certs ourselves, adding our own CA to the list of trusted CAs and only accepting certs signed by our CA? We don't really want to do this though as it does not scale to support the amount of users.
- Would it be better to give a signing cert to the users' parent company, and allow them to issue client certs. We then would only trust certs from the signing cert (or from our own CA, which would be in the trust tree).
I am asking a lot here, I know. If need be, I can refine the question with some guidance.