[GH-ISSUE #125] Generate CA + client certificate pair for client authentication purposes #70

New issue

Closed

opened 2026-02-25 22:32:31 +03:00 by kerem · 2 comments

kerem commented

2026-02-25 22:32:31 +03:00

Owner

Originally created by @schweikert on GitHub (Feb 1, 2019).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/125

This is related to #89, but goes a bit more into the detail about how generating client certificates could be useful:

What I recently started experimenting with, is using client certificate authentication as a sort of SSH's authorized_keys, but for the web. Often you can configure on a web server a list of CAs that are accepted for client authentication. This is the case for example with nginx's ssl_verify_client /ssl_client_cert...

The idea would be to:

Generate a new self-signed CA (with key and certificate)
Generate a new client certificate, signed by the above CA (also key + cert)
Delete the CA key. Now you have:
- CA certificate -> this is your public key
- client certificate (key+cert) -> this is your private key
Load the client certificate in the browser (best is to use the PKCS12 format with a password)
Put your personal, self-signed CA in the list of accepted certificates on the web server.

I was wondering on writing also a tool / script to facilitate this, but it would be awesome to have this functionality in mkcert! Maybe something like:

mkcert -client-adhoc -name "Firstname Lastname" mycert
# generates:
# - mycert.ca.pem  -> CA certificate, put this in your server config
# - mycert.pkcs12   -> client certificate to load in the browser

I have to say: I wonder a bit why nobody seems to be doing this (using client certificate like ssh's authorized_keys)... Maybe it's a bad idea? It seems like a very practical thing, especially for testing.

Let me know your thoughts... Maybe I could try implementing this.

Originally created by @schweikert on GitHub (Feb 1, 2019). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/125 This is related to #89, but goes a bit more into the detail about how generating client certificates could be useful: What I recently started experimenting with, is using client certificate authentication as a sort of SSH's authorized_keys, but for the web. Often you can configure on a web server a list of CAs that are accepted for client authentication. This is the case for example with nginx's ssl_verify_client /ssl_client_cert... The idea would be to: - Generate a new self-signed CA (with key and certificate) - Generate a new client certificate, signed by the above CA (also key + cert) - Delete the CA key. Now you have: - CA certificate -> this is your public key - client certificate (key+cert) -> this is your private key - Load the client certificate in the browser (best is to use the PKCS12 format with a password) - Put your personal, self-signed CA in the list of accepted certificates on the web server. I was wondering on writing also a tool / script to facilitate this, but it would be awesome to have this functionality in mkcert! Maybe something like: mkcert -client-adhoc -name "Firstname Lastname" mycert # generates: # - mycert.ca.pem -> CA certificate, put this in your server config # - mycert.pkcs12 -> client certificate to load in the browser I have to say: I wonder a bit why nobody seems to be doing this (using client certificate like ssh's authorized_keys)... Maybe it's a bad idea? It seems like a very practical thing, especially for testing. Let me know your thoughts... Maybe I could try implementing this.

kerem closed this issue

2026-02-25 22:32:31 +03:00

kerem commented

2026-02-25 22:32:32 +03:00

Author

Owner

@FiloSottile commented on GitHub (Feb 2, 2019):

Added -client. You can use $CAROOT to have a dedicated CA.

@FiloSottile commented on GitHub (Feb 2, 2019): Added `-client`. You can use `$CAROOT` to have a dedicated CA.

kerem commented

2026-02-25 22:32:32 +03:00

Author

Owner

@alexfornuto commented on GitHub (Nov 29, 2021):

@FiloSottile Sorry to ask on an old issue but I don't see a better spot for this question: How can one change the default password of a client certificate when generating it?

@alexfornuto commented on GitHub (Nov 29, 2021): @FiloSottile Sorry to ask on an old issue but I don't see a better spot for this question: How can one change the default password of a client certificate when generating it?

kerem referenced this issue

2026-02-25 22:33:19 +03:00

[PR #71] [MERGED] nss: use certutil from $PATH if found on macOS #380