Client Authentication Certificate

A client authentication certificate must be an X.509 certificate signed by a CA trusted by the server. When a certificate is requested by the server, the client can either send the certificate or try to connect without one. The server then permits the connection if it trusts the client certificate. If the client is attempting to establish a connection without a client certificate, the server may permit the connection, but at a lower security range.

Similar to a server certificate, CAs can issue client authentication certificates with distinct classes. The classes reveal the level of investigation done by the CA to verify the identity of the client requesting the client certificate. These are usually out-of-bandwidth procedures like face-to-face interaction with the client. Classes are particularly important when the certificates are issued by an external CA because it is important to ensure that the CA took all the necessary steps to verify the client's identity.

All client authentication certificates include some or all of the following info:

• SSL version number, certificate's serial number, and other information that represents the certificate
• CA name
• Client name
• Certificate validity (expiration date of the certificate)
• Public and private key pairs
• Additional info, based on the x.509 certificate version
• CA's digital signature