I've been given a requirement of providing a client certificate to authenticate between two application's web services. The other application (that I don't host) is requiring an SSL client certificate that is signed by a 3rd party CA (ie. Symantic, RapidSSL, etc.) and not be self-signed. After going through most of the CA's websites and Googling around, I can't seem to find a proper answer on how to get a signed client cert.

Is there something I'm missing in CSR documentation that'll allow me to generate a client certificate? I've seen a few of the bigger CA's offering "managed PKI" services which are about the only mention of signed client certificates that I can find, however, those seem like they might be terribly expensive services for what I'm trying to get.

Thanks in advance for the help.

  • I looked into this once for a project. Those expensive managed PKIs are the only option if it must be signed by a CA. The government and others use their own CA that they have set up. Commented Jul 2, 2014 at 14:44
  • You may find StartCom to offer a more attractive fee for what you're doing vs a big company like Symantec. They say it costs about $2/cert. But, you will need to issue at least 1,000. Commented Jul 2, 2014 at 14:52
  • Thanks for the feedback. Unfortunately, I won't be needing that many certs... though, for all I know, that price may be cheaper than the other managed PKI services. Commented Jul 2, 2014 at 15:15
  • The other application's admin can generate a client certificate signed by their own internal CA and hand it to you, which in turn you can pass on to them to authenticate your client. Since they issued the client cert, they should be able to verify it. This solution doesn't require any real CAs like verisign etc. Will something like this not work for you? Commented Jul 2, 2014 at 16:49
  • Yeah, I thought of them generating ones for us to use, so we'll see if that's a possibility. Thanks. Commented Jul 2, 2014 at 19:53

1 Answer 1


Unfortunately, the only way to get a CA client certificate is by using the managed PKI solutions you have mentioned. As I have mentioned in my comment StartCom StartSSL Corporate may be the cheapest at around $2/certificate but says its for 1,000 certificates you have to contact them for an exact price.

Another solution that may be possible (depending on your requirements) would be to use OpenID with StartSSL Open Identity. In this instance your users would just have to sign up with StartSSL and could login with their certificate. Of course, you would not have as much control this way as the certificate would not be revokable by you and such, but you may be able to add aditional code to your application to handle the shortcomings of this solution.

The last option would be to roll your own Certificate Authority (which could be easy if you only need it for authentication). The only downside is it sounds like this is not allowed by the other application. You could use OpenSSL to achieve this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .