Category Archives: client

Client Authentication – Multiple Devices

Posted on by

I am making a website that requires username, password and a certificate (this last contain the public key of the end user).

Update Question

When the user is registering to the website, it obtains the certificate from the server.

  1. The client is registering to the website, generates its keypair
    (private key and public key) and sends to the server a CSR in order
    to request a certificate.
  2. The server sends to the client the certificate requested. For others purporse (i.e. challenge response, decryption/sign etc.) the client could use its private key generated during the first access.
  3. Now, if you suppose that the end user
    accesses from another device using the same credentials, how can the
    server manage this new device? How can I share the private key among multiple devices (one account->more devices). Is this a valid approach or is it preferable using 1 certificate each device?

Furthermore, this certificate is stored in device’s memory. But what happen when the user try to login from another device? How can I manage the relationship with one user->one certificate->multiple device? How can I manage the relationship “user/private key/multiple devices”?

I have heard something about a VPN, but I don’t know if there are other best practices (approaches).

Continue reading Client Authentication – Multiple Devices→