How to force browser to ask user to resubmit certificate after a logout

Question

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from the cert, a lookup is done and the user is logged in.

In the case of cert auth, if a user logs out; he can just log back in without manually resubmitting the certificate. The browser will do that for him automatically. I see this being a bit undesirable because the user thinks he's logged out but on clicking the URL subsequently, the user is just sent right through.

Is there anything we can do to make the browser to re-check the certificate submission with the user after a logout or for a specific event? We can't change browser settings because we can't go to all the end users and ask them to clear their ssl cache.

Answer 1

Client side certificates are currently is a mostly enterprise used feature, And it relies heavily on the web-browser to manage when to send what certificate to the server (in mostly an ugly ui element).

So currently using a login only based on the certificate means you auto-login each time you use the certificate. (the browser remembers you want to use the certificate and re-uses it when you connect).

The only way to stop the browser from doing this is client-side. the user needs to 'tell' the browser to NOT send the certificate.

a different way to facilitate both certificate login and user/password login is by having 2 different login pages, one for password login, and one for certificate login. So a end user can choose what type of login he / she / it wants to use.

There is of course also the possibility to revoke the certificate the user has and require him/her/it obtain a new certificate to login. a revoked certificate would trigger the browser to give the user a "selection box" to submit a new certificate.