i am trying to achieve this:

i have a bunch of users who log in to my website. some of the user can opt to be allowed to log in using their selected devices. for this i am planning to use ssl based client certificates which users can install in their browser.

How do i then check for the presence of the valid certificate? i cannot just use it at the web server(apache ,nginx) level as only few users are to be bound to devices.

How does this flow works at implementation level? i have a reference point here

for testing purpose i have a PKI setup up with a root CA and an intermediate CA that is used to create sign the device certs.


The basic work flow is that you don't make client certificates mandatory but optional, i.e. ssl_verify_client optional instead of ssl_verify_client on in nginx. Then the server will ask the client to provide a certificate. If the clients sends none the server will not fail. If a certificate was send by the client the content of the certificate can be checked from your web application.

How exactly the configuration of the server and the integration with the web application is done depends on the specific environment and framework you use (i.e. nginx vs Apache vs IIS vs ..., PHP vs ASP vs Django ...) and the necessary details should be available in the related documentation. Any questions regarding specific configuration and access from your program would be more a question for stackoverflow.com.

  • i have to make device/client certificates mandatory per user per device for users who have opted for device certificates. somethign like the link that i have posted in my question above – anekix Mar 31 '19 at 5:15
  • i need something like this. if a user is using one particular device that has the CERT then the request is valid .if the same user is using some other device without the cert the request should fail/show some error instead of getting passed further – anekix Mar 31 '19 at 5:22
  • 1
    @anekix: How you configure which users need certificates and then enforce this policy in your program is more a programming question which is specific to your (still unknown) environment and framework, i.e. off-topic here and too broad (since too much unknown) in the current state elsewhere. Apart from that, don't just all-uppercase words for no reason: CERT is the computer emergency response team and not the certificate. – Steffen Ullrich Mar 31 '19 at 5:22
  • 1
    @anekix Essentially, using Steffan's answer will tell the client to supply the certificate if there is one. Within your "user management" system, you would need to record whether a particular user "must supply" a certificate. If a "must supply" user attempts to login but doesn't supply a certificate (because they are on another device without their certificate) then you reject the attempt (or, perhaps, fall-back to some other authentication method). – TripeHound Apr 29 '19 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.