Would it be possible to use cookie to store SSL Client Certificate?

Question

Lately, I was reading that article about SSL client certificate.

Why is nobody using SSL Client Certificate?

The answer was to that question was :

In the current state, this excellent idea is rendered completely useless by the awful usability and the completely detached nature: This is a browser feature. It's browser dependent without a way for the sites to control it - to guide users through steps.

For this to work, sites need more control.

Without giving them access to your keys.

So basically, it's a usability problem.

That made me think about cookies. Cookies are client side storage and there is nothing more easy to use than them. In fact, most users don't even know they exist. So, I thought that cookie might help here.

The part I'm interested in is 2 factors authentication.

• Something that you know : your password
• Something that you have : your private key for the "certificate"

Would it possible to use cookie in some clever way to provide 2 factors authenticate by storing a "certificate" in them?

Answer 1

A cookie has only one function: to be sent back to the server. It is stored on the client, but the client does not understand its contents; and the client does not use it except by sending it back.

Which basically explains that the "answer" you quote is not a real answer: it tries to side-step the problem by stating that side-stepping the problem would be cool. The whole point of cookies is to be client-side storage under control of the server; the whole point of client-side certificates and private keys is to be client-side storage that is NOT under control of the server.

In fact, client-side certificates have no real value when there is only the client and the server. Certificates make sense when a third entity enters the dance: the Certification Authority. A certificate uses asymmetric cryptography so that the client may prove its identity to the server without allowing the server to impersonate the client; this contrasts with show-the-password authentication methods in which the server necessarily learns the user's password in the process. That property of certificates is of any use only if the server was not the one who issued (signed) the certificate in the first place; otherwise, a dishonest server may emit fake user certificates at will.

So the lack of client-side certificates in the Web as we know it right now is not really a "usability problem"; it rather pertains to the idea that certificates don't have extra value for the way Web sites handle authentication (namely, each site handles its own authentication needs). Delegated authentication (like OAuth) may change this model, which would then indirectly prompt for more deployment of client-side certificates, with better user interfaces.