Re: preventing client certs to be used by multiple users??

On 8/31/05, Conrad Friedrich <[email protected]> wrote:
> Is there a way to prevent users (that got a client ssl-certificate (pkcs12)
> for accessing my server) from giving their certs away to others and in that
> way enabling "unwanted" users access to my site?

The client certificate acts as the user's identity.  If the user gives
away his/her identity or the identity is stolen, then someone else can
authenticate to the server using that identity, and that's just the
way it is.  This is no different than a username/password means of
establishing user identity, really, except that the user has perhaps
better ways to protect a client certificate than he does a
username/password.  If the user intentionally gives away the
certificate, there's nothing you can do about it.

> Or if there is no elegant solution, maybe someone knows how apache (or a log
> analyzer etc.) can inform me if two different IPs have tried to connect
> simultaneously using the same certificate?

I haven't seen any such tool but that doesn't mean there isn't one out
there.  Anybody else heard of such a thing?

--Cliff
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]