klientcertifikat

A klientcertifikat is a digital certificate used by a client to establish its identity to a server within a public key infrastructure (PKI) and TLS. It is typically an X.509 certificate issued by a trusted certificate authority (CA) and bound to a private key controlled by the client.

In TLS mutual authentication, the server may request a client certificate. The client presents the certificate and proves possession of the corresponding private key. The server validates the certificate chain and checks revocation status before enabling a secure session. If the certificate is trusted and valid, the client is authenticated as part of the connection.

Issuance and management: A CA verifies the client's identity and issues the certificate, which contains the subject name, public key, validity period, and issuer. The private key should be securely stored by the client. Certificates can be revoked via certificate revocation lists (CRLs) or OCSP, to prevent usage after compromise or role changes. Renewal is common before expiration.

Common use cases include securing web APIs and internal services through mutual TLS, authenticating VPN clients, and enabling email security (S/MIME) or device authentication in corporate networks. By requiring a client certificate, systems can confirm the exact identity of the connecting party without relying solely on usernames and passwords.

Formats and storage: Certificates are typically encoded as PEM or DER; private keys are often packaged with the certificate in PKCS#12 (PFX). Private keys may be stored on hardware tokens, smart cards, or software keystores to strengthen security.

Security considerations include protecting the private key, choosing appropriate validity periods, implementing revocation checks, and managing trust anchors. The lifecycle includes issuance, distribution to the client, deployment, periodic renewal, and revocation if compromised.