2

When using x509 certificates for authentication, I understand that there is a shared source of trust (the signing certificate authority). So that explains why a server is able to authenticate the client with a certificate.

But once the server says "yes I trust you because of your certificate", how can it distinguish who the certificate bearer is?

For instance, with username/password once the server authenticates the password it can use the username part to know who it is and what this client is authorized to do.

What is the "username" identifier in the certificate authentication scenario?

2 Answers 2

2

Although the answer provided by @mti2935 is partially correct, it lacks some useful details.

Servers often use Subject Alternative Name extension to identify the client. SAN extension includes one or more names that uniquely identify entity in identity directory.

For example, a DNS Name name type with unique client device name (often FQDN, but not necessary). You can't have multiple different devices with same FQDN.

A User Principal Name name type can be used to identify the user (which uses email syntax). Again, UPN uniquely identify user in identity directory.

Server must be able to create a 1:1 mapping between name in SAN to entity in identity directory.

7
  • Thank you for the answer! So it sounds like SAN is where I should be putting the client identifier but it's a little confusing that it's a DNS name. What would that look like? Something like user1.organization1.com? Or am I missing something? Nov 11, 2021 at 14:39
  • DNS name is used for devices. For users, other name types shall be used. For example, you can use RFC822 name type or another. Microsoft uses Other Name name type with User Principal Name (which uses same email syntax) identifier to identify users.
    – Crypt32
    Nov 11, 2021 at 14:42
  • Oh ok really good info. And this email syntax doesn't actually have to be a functioning email address, right? Just like DNS name for devices, it's really just an identifier that can be used as needed? So for a user, you set SAN to UPN/email address. Makes sense! Nov 11, 2021 at 14:54
  • Interestingly, looking through a handful of client certificates it seems like they still heavily utilize CN for identification. I see that it was "deprecated" decades ago, but it's still used a lot? Nov 11, 2021 at 14:58
  • In Active Directory (which is a great example, in my opinion), every user has UPN. It is unique in entire AD forest. Users may not have email, but they have UPN. It can be used for email as well, but it is not necessary. In simplified examples, when custom directories are used, you can use different identifier. For example, SAN supports GUID name type. If you can make association between GUID and user -- use it.
    – Crypt32
    Nov 11, 2021 at 14:58
3

As you mention in your question, a certificate is 'bound' to some entity. The entity could be a person, a company or organization, a DNS hostname, etc. It is the role of the CA to ensure that the entity asking the CA to sign the certificate is who they say that are. The name of the entity is typically stored in the Common Name field of the certificate, and/or the Subject Alternative Name field of the certificate. See https://stackoverflow.com/questions/5935369/how-do-common-names-cn-and-subject-alternative-names-san-work-together for more info.

As for your secondary question of how to associate a user account with a client certificate, see https://cweiske.de/tagebuch/ssl-client-certificates.htm for some interesting reading on this subject (in particular, the section 'Certificate Identification').

4
  • Thanks so much for the quick answer! So basically the server can use CN and SAN to figure out the "who" part of the certificate? Nov 11, 2021 at 13:55
  • It looks like on some of my client certificates (in my browser) the Common Name is set to some GUID, which I'm assuming the server applications translate to my identity. Nov 11, 2021 at 13:56
  • I think the question was about client certificate authentication on a server, not about certificate request from CA. After certificate is issued, CA plays no role in client-server communications.
    – Crypt32
    Nov 11, 2021 at 14:05
  • OP, see cweiske.de/tagebuch/ssl-client-certificates.htm (scroll down to the section 'Certificate Identification') for some interesting reading on how to associate a user account with a client certificate. @Crypt32, I agree, but I think it's pertinent to understand the CA's role in the verification and issuing process as it pertains to the info in the CN and SAN fields.
    – mti2935
    Nov 11, 2021 at 14:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .