If you have a Web site that you want users to access easily and the bullet above doesn't apply, then you probably do not want client authentication.

Both you and your users accessing the server must perform steps to set up client authentication.

If you set up server authentication, the data transmitted is still secured and the server identity is validated for the user.

Do you need to gather information on users accessing your server or control access to databases based on the user identity? If not, don't bother with client authentication.

Before you commit to using client authentication at your organization, here are some things to think about: You could have many digital signatures attached to a single certificate, depending on the number of trusted roots you merged.Ĭlient authentication may not be the security solution for everyone.

The digital signature of the CA is added to the client certificate when you merge the CA as a trusted root.

Depending on the version of the x.509 certificate you are using, your certificate may contain additional information and extensions.

Release 4.6.1 also allows 128-bit encryption for communication to international sites if the site uses the VeriSign Global ID. If you are using software licensed in North America, you can use up to 128 bits for the session key. The negotiated session key is the encryption key created when initiating an SSL session between the server and client. The key pair is the public and private key combination that uniquely identifies the client.

The larger the size used when generating the key pairs, the stronger the security.ĭo not confuse the key pair size with the negotiated session key. The key pair size indicates the strength of the security. You can select the size of your public and private keys however, you cannot make this choice if you are creating an international key pair - 512 bits is your only choice.

The public and private key pairs are generated when you send your request to the CA and are used for client identification and encryption over the network.

If you already registered using Notes, the client name is the common name that appears in the Person document. This is a hierarchical name, for example, Joann Spera/Acme/Lotus/US.

The client name is the name you specify when you request a certificate.

The validity period is the date on which the certificate was issued and the date it will expire.

The CA name is the name of the CA that issued the client certificate.

The certificate information section contains information about the SSL version number, the serial number for the certificate, and other information that identifies this certificate.

You can think of a client certificate as follows: Figure 1.

Ssl talkback schematic