We have a web app that uses client certificates for authentication, and this causes problems for users that have client certificates, but not ones for our app.

Indeed, they have a popup showing up asking to provide a certificate when the SSL connection is initiated, but they don't have a certificate for our app (they have some client certificates for another app), so they have to close the popup and log in with user and pass.

Is it possible to send to the user the CN that we need at SSL negociation, so that the browser does not show the popup if the user does not have a proper certificate?

I found out about SNI, which is kind of the same thing in reverse, for the server to choose which certificate to present to a client, but there does not seem to exist for the opposite.

Any idea?

  • use letsencrypt – Ipor Sircer Sep 19 '16 at 7:48
  • You don't seem to understand the question. This is about client certificate, not server certificate! – Gui13 Sep 19 '16 at 7:49

The server can only request a client certificate or not and additionally provide a restriction which CA's are accepted as the issuer of the client certificate. What a client does with the information is fully up to the client, i.e. the server has no control over it.

There is no way for the server to only optionally request a certificate. The server can ignore if it got no certificate but the client does not know if the certificate is essential or not, it only sees that a certificate was requested. This means that client will ask for the certificate because the server asked the client to provide one.

  • All right, I have another idea: simply provide 2 endpoints: one for password auth, the other for certificate auth – Gui13 Sep 19 '16 at 8:05
  • You can configure Apache to allow certificate based authentication for those clients that do present them, and fall back to Basic authentication with a password prompt for those who don't. Then at least the prompt displayed to your users experience is always the relevant one. httpd.apache.org/docs/2.4/ssl/ssl_howto.html#intranet – HBruijn Sep 19 '16 at 8:29
  • @HBruijn: SSLVerifyOptional only makes the server accept if the client sends no certificate. It still sends a certificate request to the client, i.e. there is only a CertificateRequest in the TLS protocol and not an optional certificate request. This means that the client does not know if the server will accept no certificate and will thus prompt the user for a certificate. – Steffen Ullrich Sep 19 '16 at 8:32

Your Answer

