1

We are developing an application, that is using client certificate needed for client authentication (HTTPS connection) when using a specific web service. When a customer company has hundreds of computers, the IT admin has to install this client certificate on each computer (and every year when the client cert is renewed).

My question is, is it possible to have the client certificate in a single place (single computer, server), so all PC clients will somehow obtain certificate from this server? But what about the private key, which is needed together with the client cert, during the authentication.

And to make it harder, is there a solution that does not require a more complex hardware solution like a domain (as some customers have only a very simple network with a few computers)?

Thank You for any information.

EDIT: The client certificates are issued by the organization that operates the webservice. Each company, that uses this webservice, earns only one client certificate (so all PC clients within company use the same certificate).

  • 1
    In my opinion the way you intend to use client certificates is wrong. There should not be a single certificate shared between all clients, but instead each client should have its own certificate. A client certificate is used to authenticate a specific endpoint (user with browser) and not a whole company. – Steffen Ullrich Sep 5 at 18:34
  • @SteffenUllrich I edited my question, added information that one client certificate per one company is correct. Access to webservice is granted per company, not per user. – Shadi Sep 5 at 18:51
  • What OS are you targeting? Either way there should be a management solution to deploy this for all workstations. – LTPCGO Sep 5 at 19:47
  • 1
    @Shadi: "... one client certificate per one company is correct ..." - it might be correct from the standpoint that you want to do it this way but it is not correct from a standpoint on how client certificates are supposed to be used. By trying to use these in a way which is not intended you create the problems you currently have and which you are asking us to solve. – Steffen Ullrich Sep 5 at 20:02
  • @LTPCGO Win7/8/10. It would be fine if there exists a management solution, but customer's ITs evidently do not have any idea, so they are asking me if I can find the solution :) – Shadi Sep 5 at 20:27
0

With regard to the comments under my question, I suppose the answer from @SteffenUllrich is the right one:

"... one client certificate per one company is correct ..." - it might be correct from the standpoint that you want to do it this way but it is not correct from a standpoint on how client certificates are supposed to be used. By trying to use these in a way which is not intended you create the problems you currently have and which you are asking us to solve.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.