Take the 2-minute tour ×

I am planning to use certificate-based authentication of client in web application. Now I need a way to get information from certificate supplied by client.

How do I do that on server-side? I think that servlet container (Tomcat) whould validate certificates and fill out Principal in HttpServletRequest.getUserPrincipal

Is there something else to consider?

share|improve this question

closed as not a real question by EJP, David Stratton, tc., H.Muster, hims056 Oct 9 '12 at 7:48


Something else such as what? What's the question here? –  EJP Oct 4 '12 at 10:28
@EJP something else than getUserPrincipal method. –  jdevelop Oct 4 '12 at 10:34

2 Answers 2

up vote 2 down vote accepted

I do this with Apache + Tomcat. Apache can create CGI variables for the cert data with the SSLOptions:

SSLOptions +ExportCertData

Tomcat adds that data to all request attributes, you can obtain it using:

X509Certificate x509[] = (X509Certificate[]) 

I don't know how Tomcat handles client certs on its own, but this way it works reliable.

share|improve this answer
well, we won't have Apache in front of tomcat. Actually there might be nginx. –  jdevelop Oct 4 '12 at 10:37
@jdevelop The certificate is there in the request attribute named here whether Apache is present or not. It's mandated by the Servlet Specification. –  EJP Oct 4 '12 at 22:13

This really depends on the certificates. You can inspect the different fields of the certificate on the server side like the common name, organisation, etc. Often the common name in the certificate is (in case of webservers) the domainname for which the certificate was created. If you really want to identify the user based on the certificate alone, you need to control the certificate generation itself, and specify what should be entered by the certificate autority (or rather, the one who creates the certificate, not the one who signs them) in which fields. You could agree with the certificate creator to enter the username.www.yourwebsite.com in the common name field for instance, making the common name both unique, but also having the username inside it. But this is only possible if you control the certificate creation.

What we did ourselves, is not depend on the information in the certificate fields itself. We just trust one specific certificate authority, and we inspect the thumbprint from the client certificate, and have our own table mapping certificate thumbprints to users. The webserver then only checks if the client presents a valid certificate signed by the trusted certificate authority, and if the certificate is valid, it looks up it's thumbprint in our mapping table.

share|improve this answer
We will definitely issue client certificates by ourselves. So we will fill the data about client and use it. The question is - how to extract this data (organization unit, common name etc) on server-side? –  jdevelop Oct 4 '12 at 10:36
