2

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and separate them from those that do not in order to grant different levels of access and privilege.

When I receive the certificate on the server I can access all the parameters of the certificate but I don't know how it is possible to identify if the certificate comes from a Smartcard. At first sight the mTLS process is transparent and agnostic to the origin of the certificate, however, some websites manage to make this distinction.

How is it possible to determine somehow from the web server if the client certificate comes from a Smartcard (hardware certificate) or if it is a software certificate?

Improve this question
3
  • This looks more like a programming problem than a security problem. And there are lots of factors that you don't talk about. Do you issue the smartcards or certificates? Do you control the smartcard reader? How do you get the client cert at the point ot authentication? We need more details, and this would likely end up on Stackoverflow.
    – schroeder ♦
    Dec 9, 2022 at 9:15
  • @schroeder It is security and not programming because I ask about the mechanisms offered by mTLS or X509 certificates to identify the origin, if you notice I have not talked about any particular language or implementation, also none of what you mention is needed, since my question has been successfully solved in the first answer.
    – Luna
    Dec 9, 2022 at 20:01
  • And the answer is not about security but about service processes and program design. If you are happy with this answer, then it really is about programming and not about security. And yes, what I ask about is relevant because that's exactly what the answer suggests.
    – schroeder ♦
    Dec 10, 2022 at 11:20

1 Answer 1

Reset to default
2

You'll need to handle this at issuance. There are many strategies for this. For example, on Windows, you could require certificates be issued using keys from one of the Microsoft Smart Card Key Storage Providers. Or you could issue the certificates when you issue the smart cards, and you'd know the key was resident on them. This can unfortunately be a pretty complex topic - you have to design your issuance system so that you know the key is generated on the smart card and isn't exportable (and you have to select smart cards that are capable of generating strong keys).

You can either use a CA that only issues keys to smart cards, or add an EKU that's specific to your scenario (Windows uses a specific EKU for smart card logon authentication), or add an issuance policy OID to the certificates. Whatever you choose, that's what you'll check when the certificate is presented to make sure it's on a smart card.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .