Can you please list of advantages /disadvantages on X509 Certificate based authentication instead of traditional username/password model ?

Architecture Scenario :

Lets suppose i have Client application made a request to Server(REST API Implementation) before processing client request we want to introduce a authentication mechanism based x.509 certificate instead of routine username/password or Token based models.

and also primarily i want server-server secure service with x509

What all security challenges/complexity involved to implement this kind of authentication ?

If Client/Server communication is already using HTTPS and login mechanism is with username/password. Do i need to introduce another certificates again to overwrite this solution or same https enabled certificates can i use ?

  • Most web servers can be configured to require a client certificate. If you're using HTTPS, the client already verifies the server's certificate. What server software are you using? – Kieveli Jan 4 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.