We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from the cert, a lookup is done and the user is logged in.
In the case of cert auth, if a user logs out; he can just log back in without manually resubmitting the certificate. The browser will do that for him automatically. I see this being a bit undesirable because the user thinks he's logged out but on clicking the URL subsequently, the user is just sent right through.
Is there anything we can do to make the browser to re-check the certificate submission with the user after a logout or for a specific event? We can't change browser settings because we can't go to all the end users and ask them to clear their ssl cache.