Tuesday
May122009
Securing A Website With Client SSL Certificates
Tuesday, May 12, 2009 at 2:57PM In the comments of the last article Morgan came up with the idea of client SSL certificates to secure the admin panel. This is not authentication in a classical sense, it is saying which SSL certificates (which you self-signed) you allow to access a particular site. This is a better solution than limiting the access to various IP adresses when you are a work nomad and you have to access it from different parts in the world.
The steps to do this are:
- Setup OpenSSL to become a Certificate Authority (CA)
- Create a root CA key
- Create a key for the (sub)domain in question
- Setup your web server
- Create a client certificate and install it in your browser
Here is the HOWTO: Securing A Website With Client SSL Certificates
View Printer Friendly Version
Email Article to Friend
Reader Comments (4)
There is one really annoying feature of using SSL certificates ... they always expire when it is the least convinient :P
But, I am sure that someone resourceful is able to figure out some decent practices that makes handling soon to expire certificates easy :-)
This is major issue in our country. We use client certificates for government (taxes,
registrations, ...), online banking, colleges, stock market investments, ... And that
use ordinal people not just corporate users. In Slovenia we have government official
CAs, that are issuing certificates for free to each person, so there is basically a
requirement when doing anything officially online.
I suggest promoting this issue to a bug (not feature) due to not completely
supporting SSL standard.
There are users that are contacting us regarding Chrome support, and we would like to
at least give them some kind of more official date regarding this bug in Chrome.
I think that there should be a way to handle it. SSL certificates can be quite problematic at times when it comes to expiiring.
That's true, SSL certificates always expire when you need them the most...and it's really annoying! There must be another way to handle it