How do I support SSL Client Certificate authentication?

Question

I want to do what myopenid does -- once you've logged, you can click a button that generates you an SSL certificate; the browser then downloads this certificate and stores it. When you later go back to yourid.myopenid.com, your browser can use its stored certificate for authentication so you don't ever need a password.

So my questions is what is required to get this working? How do I generate certificates? How do I validate them once they're presented back to me?

My stack is Rails on Apache using Passenger, but I'm not too particular.

Answer 1

You can generate a certificate in the client's browser using browser-specific code. See this question

You could also generate SSL client certs server-side using OpenSSL in Ruby (see this q). (This will work in any browser without browser-specific code, but your server will have generated the client's private key, which is not ideal for crypto purists.)

Whichever method you use to generate them, you will then need to configure your webserver to require the client certificates. See the Apache docs for an example.

Answer 2

These are usually referred to as client side certificates.

I've not actually used it but a modified version of restful-authentication can be found here here that looks like what your after.

I found this via Dr. Nic's post