I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?


If authentication fails usually it's good practice to drop the connection/session, then log that as a security incident.

If the certificate is expired, consider contacting the responsible party via email or SMS and informing them.

If you notice a trend of invalid certificates then you may want to look into that as a potential attack (DoS or brute force).

Invalid certificates may be a configuration issue with a user, if you can ID the responsible user try to contact them. Most people don't really understand certs and can easily mess up the config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.