Client Certificate Authentication

SSL/TLS certificates are commonly used for both encryption and identification of the parties. Client Certificate Authentication is mutual certificate-based authentication, where the client provides its Client Certificate to the Server to prove its identity. This happens as a part of the SSL Handshake (it is optional).

Client Certificate is a digital certificate that confirms to the X.509 system. It is used by client systems to prove their identity to the remote server. Here is a simple way to identify where a certificate is a client certificate or not:
  • In the Details tab, the certificates intended purpose has the following text: Proves your identity to a remote computer

  • Verify that the Enhanced Key Usage field of the certificate has the OID set to (1.3.6.1.5.5.7.3.2).

Client authentication certificates include some or all of the following info:
  • SSL version number, certificate's serial number, and other information that represents the certificate.
  • CA name
  • Client name
  • Certificate validity (expiration date of the certificate).
  • Public and private key pairs.
  • Additional info, based on the x.509 certificate version.
  • CA's digital signature.