SSL Client Authentication Step By Step



Generate a certificate authority (CA) cert


Generate your CA certificate using this command:



Generate your Apache server SSL key and certificate


  1. Generate a server private key.
    openssl genrsa -out server.key 4096
    openssl req -new -key server.key -out server.req -sha256
    rm server.req

Install the server certificate in Apache


    cp ca.cer /etc/ssl/certs/
    cp server.cer /etc/ssl/certs/server.crt
    cp server.key /etc/ssl/private/server.key
  3. Activate the SSL module in Apache.
    a2enmod ssl
    a2ensite default-ssl
    a2dissite default
    SSLCACertificateFile /etc/ssl/certs/ca.cer
    SSLCertificateFile    /etc/ssl/certs/server.crt
    SSLCertificateKeyFile /etc/ssl/private/server.key
  6. Apply the config in Apache.
    service apache2 restart


Generate a client SSL certificate

  1. Generate a private key for the SSL client.
    openssl genrsa -out client.key 4096
    openssl req -new -key client.key -out client.req
    rm client.key client.cer client.req




8 thoughts on “SSL Client Authentication Step By Step”

  1. Hi, this is a very clear description…Thx. But one question please, can the client certificate be used as a pinned certificate in an android application?

    1. That is a very good question. I do not know the answer, sorry, but if you figure it out, please leave a comment back to let us know!

  2. Nice article. Can you please share regarding buying an certificates (Server as well as client)? Do we need to buy both the certificates(client cert & server cert) from same CA or different?

    1. I don’t have any experience with buying certificates unfortunately. I would assume they should be from the same CA though. Good luck.

  3. Hi Dan,

    i miss following configuration in your description:

    SSLVerifyClient require
    SSLVerifyDepth 1 (or more)
    SSLCACertificateFile /etc/ssl/certs/bla..bla..

    1. Hi, do you mean that those statements are required for client cert validation to take place? That is not what I have seen in practice on my server.

  4. Hi Dan,
    Could you explain the process for windows server as well? Certificate generated like above is not working in windows server.

    1. The openssl commands should work on Windows server to generate the certificates if you have the openssl software installed. Unfortunately I do not have experience with installing certificates on Windows server so I can’t help with the installation piece.

Leave a Reply to Dan Cancel reply
