I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume:

  1. Yubikey like devices that have Certs with reasonable expiration dates
  2. The organization has proper certificate revocation mechanisms
  3. Certs provide username and access-role information
  4. Browsers implement mTLS and pass the correct cert

My question is, should I just trust the certificate being passed by the browser and skip typical 'Login' prompts?

I understand a TOTP prompt could enhance this, but would trusting the certificate be a good enough baseline?

Any reference to back up your answers would be appreciated.

  • SSO (Single Sign On) means authenticating once with full credentials and then "propagating" this successful authentication when using different services. What you describe has nothing to do with SSO, it is simple authenticating with a client certificate. The full authentication happens with every new TLS connection. But in general: key based authentication like client certificates is sufficient by its own as long as the key is well protected by the client and properly verified by the server. Jun 3 '21 at 13:14
  • @SteffenUllrich as point #4 points out, the browser is sending the cert every request. While not exactly SSO, from a user perspective it's a pretty similar feel. The question is is mTLS without additional authentication accepted as good practice.
    – Liam Kelly
    Jun 3 '21 at 13:18

Modern theory of authentication is that a human user should pass a challenge from two (or all three) of the following catagories:

  1. Something you know (ie password)
  2. Something you have (ie yubikey, OTP app, etc)
  3. Something you are (biometric, fingerprint, etc)

Certificate-based mTLS (with a proper CA as you describe) provides a very strong challenge #2, but modern theory probably still recommends a password. If the client prompts for a password to use the certificate on connection (like an SSH key does), then maybe you are meeting this at an organizational level and the server does not need to enforce it.

  • if the yubikey will only use the private key if a PIN/Pass is entered or a fingerprint is read; would it then qualify?
    – Liam Kelly
    Jun 3 '21 at 14:45
  • 2
    @LiamKelly I would think you could convince an auditor that the user has the yubikey and either knows the PIN or is the fingerprint and therefore you're satisfying two categories with one action. In particular, shoulder-surfing the PIN does not get you anywhere if you don't physically have the yubikey, and conversely stealing the yubikey off someone's desk without knowing the PIN (or being the fingerprint) also does not get you anywhere. Jun 3 '21 at 16:51
  • I figured that would be the case but wanted to make sure I didn't miss something. Thank you!
    – Liam Kelly
    Jun 3 '21 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.