1

I have a simple question.

Is a web browser sends client certificate to the web server on demand(means web server is configured for client authentication and demand the client certificate) or just send all of the certificates that web browser has. If a web server send client certificate on server demand then how a web browser know which client certificate has to sent to particular web server.

Improve this question

1 Answer 1

Reset to default
4

During the SSL handshake, 

If the server requires a digital certificate for client authentication,
the server sends a "client certificate request" that includes a list of
the types of certificates supported and the Distinguished Names of
acceptable Certification Authorities (CAs).

(quote is from a reasonably lucid explanation of the SSL handshake by IBM.)

The client then compares the certificates in its store against that list to see if it has any signed by the CAs that the server listed. If it finds one, it will send it, usually after prompting the user whether they want to send it. Presumably if there were multiple matches it would ask the user which to send (if any).

(Updating to answer comment below with regarding GAE):

This page appears to be a Google employee saying that App Engine doesn't support Client Certificate authentication. Now, that's dated 2010, so I wouldn't take it as the final word, but it is a flat-sounding "no".

This question is looking for the same thing, and that person got redirected to look into OAuth2 via Google Cloud Endpoints. Perhaps that would serve your needs well enough?

Improve this answer
1
  • Thanks for your answer. One more thing I have created an application in tomcat that perform mutual authentication between server and client. I wanted similar application in GAE but i didn't find any help. Do you have any idea or source for doing this.
    – Waqas Ali
    Nov 29, 2013 at 6:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .