2

At the moment in our setup, we only have one SSL certificate used by 10 staff to access our web portal via https from out of office.

One person is leaving, but he would still be able to access our web as he can still keep the single certificate on his device. We want to stop his access, but we can't revoke the certificate which would affect other people.

One obvious solution is to recreate new certificates one for each user. I'm wondering whether there is another solution to still use the current one certificate but stop only specific user?

Improve this question
1
  • Isn't this the incorrect use of a certificate? Shouldn't there be credentials instead?
    – Michael
    Commented Jun 24, 2017 at 19:36

1 Answer 1

Reset to default
6

One certificate equals one key. If multiple person are tied to the same key, you cannot:

  • Change the key for a single of these person
  • Give attribution to actions, a.k.a. properly authenticate an individual.

No there is no way around this. Either the certificate is invalidated, or it's still valid. There's is no middle ground.

If you want to avoid the trouble, issue one certificate per individual.

Improve this answer
2
  • Shouldn't a certificate ensure you're talking to the correct server, and should not be used for authorization?
    – Michael
    Commented Jun 24, 2017 at 19:40
  • We're talking about client certificate here.
    – M'vy
    Commented Jun 26, 2017 at 8:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .