I am trying to determine best practices for implementing a webapp running in an extremely tight PKI environment. Assume:
- Yubikey like devices that have Certs with reasonable expiration dates
- The organization has proper certificate revocation mechanisms
- Certs provide username and access-role information
- Browsers implement mTLS and pass the correct cert
My question is, should I just trust the certificate being passed by the browser and skip typical 'Login' prompts?
I understand a TOTP prompt could enhance this, but would trusting the certificate be a good enough baseline?
Any reference to back up your answers would be appreciated.