We have a client server system implemented. Where client communicates using HTTP request. We have a one time token based authentication system and also sign the URL for authenticity.
We do the signature verification of the URL at the server side using public/private key procedure using client certificate. So, the client certificate is more used for a signature verification purpose not for authentication
Now we want to move away from the certificate passing. Is it somehow possible to achieve this digital signature mechanism without using a certificate ? Or how can i achieve this with out an asymmetric key exchange ?
Best Regards, Saurav