The Ultimate Guide to SSL/TLS Client Authentication: Know How it Works

Are You Aware That SSL/TLS Is Not Only Meant for Servers, but It Can Be Used for Client Authentication?

In this digital age, you know how vital SSL/TLS certificates are, how Google makes it a compulsion to have it on every website, and how popular web browsers like Mozilla and Google penalize on their browsers if anyone fails to imply with their policy. And, many even know that it’s installed on servers. But what if we say that SSL/TLS Certificates can also be installed on your PC? Well, it’s not something many people, especially regular non-technical users, know about it.

If you come into the debate that SSL/TLS Certificates are used on servers, yes, you’re right, it’s used for installing on the servers. But, that’s also true that SSL/TLS certificates are helpful in client authentication. And, today, we’ll explore this in detail.

As the name implies, SSL/TLS client authentication is intended towards clients instead of a server. Usually, when it comes to server certificates, the client (browser) is the one who does the verification of the server’s identity. In return, if the server and its certificate are legit entities, then it establishes a connection. Also, this entire process is known as SSL/TLS handshake.

Now, let’s look at it from the opposite direction.

What if a server verifies the client? Quite unheard. Well, it happens. SSL/TLS client authentication is quite like SSL server authentication, but it does contrarily.

What is SSL/TLS Client Authentication?

In this SSL/TLS client authentication, the client makes a keypair for authenticating it with the website (server). Here, the private key of an SSL/TLS certificate remains with the client rather than the server. Also, it’s kept in the browser, and the server confirms the private key’s authenticity and then creates the way for secure communication.

In other words, both client and server certificates are digital certificates that involve client and server applications. But they’re entirely different things. For instance, a server certificate is sent to the client at the beginning of a session, and the client uses it to authenticate the server. Whereas a client certificate is sent to the server from the client at the beginning of a session, and the server uses it for the client authentication.

Put simply, SSL/TLS client authentication is one of the mechanisms, which allows applications to identify certificates. SSL/TLS client authentication lets your application make sure that the client is an authorized certificate, though it doesn’t make any claim whether it’s trustworthy. Also, it’s often combined with strong password-based authentication, which helps to attain better security.

Here’s Where SSL/TLS Client Authentication Can Be Used

The common example of client authentication for application is when you want to limit the access only to authenticated users. It’s helpful against attacks that are done from other sources. Most of the time, attackers tend to imitate someone by stealing the user’s login credentials. Everyone is aware that security is more than passwords. Even technologies like 2FA (Two Factor Authentication) are accepted widely.

Also, among these two, Server certificates are often used, making them well known, as it’s an integral part of every SSL/TLS session. On the other hand, Client certificates are used on rare occasions because,

The client certificate has to be installed on client applications/machines, which is quite a tedious job for system admins.
Mostly, clients or end-users are not technical, and they are not interested in getting into it that stuff.

which makes SSL/TLS Client authentication sound quite new to users when they get to know about it.

Client Handshake

When it comes to client handshake, once the client and server hello messages are over, the server asks the client to present themselves with a certificate. And, once the server verifies that certificate, encryption is done via symmetric encryption.

Typical Client Handshake:

Also, before a secure connection takes place, an SSL/TLS handshake is done for handling authentication and negotiation among the protocol versions and ciphers, which is used once the connection is made. Usually, after the arrival of the client-server provides the certificate, and the client is responsible for handling authentication functions.

And, this process takes place after the completion of certain certificate verification like:

Digital signature is trustworthy.
Timestamps are valid – Not before and after dates.
Certificate is not revoked (OCSP or CRL.)
Certificate Transparency (CT) are correctly logged.

Benefits of SSL/TLS Client Certificate Authentication

However, SSL/TLS Client certificate authentication does offer certain benefits like:

2-FA (Two-Factor Authentication) can be performed without an email being sent or an SMS code.
It’s one of the inexpensive methods to accomplish 2FA.
Encrypts network transactions.
Offers more than authentication, like integrity and confidentiality.
Based upon Active Directory, access is restricted by users, groups, roles, or devices.

Here’s Why SSL/TLS Client Authentication is Not Popular Like SSL/TLS Server Authentication

Though the SSL/TLS client authentication looks good when it comes to practicing, it’s a bit disappointing. Some of the reasons are:

Not Convenient

As client certificates are stored in a browser, its usage for one system gets limited. In an age where a person has plenty of devices, it can be inconvenient. And other questions like what if the devices stop working or it gets stolen do arises.

Not Easy for Non-Technical & Regular Internet Users

Support and installation guides are readily available for server certificates, which doesn’t make anything complicated to any non-technical person. But, that’s not the case for client certificates. Everything must be dealt with on their own, which becomes quite tedious if the user is not experienced or doing it for the first time.

2FA (Two-Factor Authentication):

To cope with the drawbacks of passwords, two or multi-factor authentication are preferred highly. And, compared to client authentication, this MFA (Multi-Factor Authentication) is easy to use, which gives a rapid adaptation among the users while making client authentication less desirable.

Wrapping Up

SSL/TLS client certificate authentication is a mutual authentication based upon certificates, where the client offers its Client Certificate to the Server for proving its identity. Though it’s a part of the SSL/TLS Handshake, it’s optional.