I seem to have mis-understanding around client auth certs...

If you have software that will use Client Auth certificates over SSL (such as those installed on a remote desktop via Windows Certificate manager), and this has proven to work with self-signed certs....

Where / how do you purchase a 'client auth cert' that would be from a trusted CA vs private?

  • 1
    Client Certificates are most commonly used with a private CA, because they're usually used to authenticate "valid users for organization X" and not "users from anywhere who organization X wants to trust a CA's validation of"
    – gowenfawr
    Commented Jan 27, 2015 at 19:52
  • Thanks gowenfawr for that feedback - so what is the normal procedure when you have a trusted CA SSL/TLS cert on the server, or are the server certificates unrelated to the client certificates?
    – dhartford
    Commented Jan 27, 2015 at 20:08
  • There is no relation between the two - the server certificate can be whatever you want, and should be CA-signed to provide reasonable assurance to your visitors that you are who you are. The server is configured to accept client certificates signed by (your chosen CA), and the assurance you have is that you control the process of handing out those certs to just the right people. With client certs the assurance usually lies in controlling the distribution process, not trusting a 3rd party CA to distribute them.
    – gowenfawr
    Commented Jan 27, 2015 at 20:15

4 Answers 4


Why do you need the client cert to be signed by a commercial CA?

This is needed for the server side since commercial CA act as a trusted third party for most client application since they have no way to check your public certificate authenticity otherwise.

Most often when using client-side authentication the authority is the organisation owning the server you want to authenticate to, and this is this organisation which will provide or sign you the required client certificates. In other words, if you want to connect to a server owned by company 'A', you need a certificate signed by company 'A' to proceed.

However, for some very specific use cases (some financial transfer protocols for instance) customers can come on board using certificates signed by a trusted third party, but in this case the company you want to connect to will provide you the list of trusted third parties you can choose from (Swift is the most common in this area, but there are a few others).

  • If you are the entity owning the server, and you create a client cert for computers/users outside your network, do you have to also put that creating CA root cert on those (outside your control) computers? (my ignorance is greater than expected, so help me learn please :-)
    – dhartford
    Commented Jan 27, 2015 at 20:14
  • 1
    You can freely distribute the public version of the creating CA root to your client along with their private or signed certs, it depends on the exact client software used but some might indeed require it. At the opposite, the private key associated to the creating CA must remain secret and well protected at all cost. Commented Jan 27, 2015 at 20:32

The most commonly available SSL certs have a specific field which says it can't be used as CA root/intermediate cert, thus for issuing new certs.

From openssl x509 -in cert.pem -noout -text:

X509v3 Basic Constraints: critical

I believe it is not possible to purchase a publicly trusted CA cert easily, it would broke the whole trust chain model.

Continue to GZBK answer, to see why you don't need it for signing client certs, you can do it with a self-signed CA cert.

  • As soon as I get enough rep, I would upvote this answer for the specific example and additional info around needing new CA (not try to use a commercially acquired SSL Cert) to create the client cert. :-)
    – dhartford
    Commented Jan 29, 2015 at 14:28
  • 2
    This answer misunderstands the question. A CA certificate is not what is sought, but a certificate for use as "client", "digital signature", and/or "clientAuth" signed by a widely trusted CA. Commented Jun 19, 2020 at 17:43

The answers so far cover topics around the question but didn't really answer the question directly.

Where / how do you purchase a 'client auth cert' that would be from a trusted CA vs private?

Most of the certificate sellers sell server certificate since it is the most common use case.

To find client certificate from commercial trusted CA, you have to search a little harder to find . For example, you can find from Comodo.

You can also get a free client cert from CAcert.org


There are a large number of commercial CAs you can buy from. Symantec is the largest but a google search of "buy ssl certificate" will give you a few thousand other options.

  • 1
    You can't use regular SSL certs to issue new certs. See my answer.
    – zakjan
    Commented Jan 28, 2015 at 3:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .