{"id":9986,"date":"2018-01-25T16:30:12","date_gmt":"2018-01-25T16:30:12","guid":{"rendered":"https:\/\/clone4.10pearls.com\/?p=9986"},"modified":"2026-07-30T11:34:48","modified_gmt":"2026-07-30T11:34:48","slug":"certified-based-authentication-using-pki","status":"publish","type":"post","link":"https:\/\/10pearls.com\/uk\/blog\/certified-based-authentication-using-pki\/","title":{"rendered":"Certificate-based authentication using PKI"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Authentication enables applications to verify that the user trying to access them really is the user they claim to be. Most common web and mobile applications<\/a> do this is by using:<\/p>

  1. User ID and Passwords<\/li>
  2. Multi-factor Authentication (e.g., ID and password, call, text, email link, key generators)<\/li>
  3. Certificate Based Authentication (CBA)<\/li><\/ol>

    When 10Pearls is developing new products<\/a> for our clients, we often recommend CBA above the other methods of authentication. Why? Let’s dive in.<\/p>

    What is CBA (Certificate Based Authentication)?<\/h3>

    At a high level, CBA works by granting an application the ability to validate and verify the identity of a user based on a proof of identify through trusted Digital Certificates. Most banking applications use CBA behind the scenes and further protect the digital certificate using a fingerprint or a passcode.<\/p>

    Think of a digital certificate like an ID card: It shows who you are, names the authority that issued the card, and confirms that you are the only person who has this card. It also has an expiration date and is tamper-proof.<\/p>

    Why not just use passwords? A number of reasons, including but not limited to: people are notoriously bad at making and using passwords, password breaches<\/a> are so common they’re barely a blip in the news, and of course people compromise passwords every day by writing them down on a sticky note. There are certain other cases when a password alone is not compliant with laws, regulations, and policies. In these cases, CBA is often the better option.<\/p>

    \"CBAHow does CBA actually work and how is it implemented?<\/h3>

    To break down the process in the simplest possible way, let’s go back to thinking about a digital certificate as an ID card. Imagine you just turned 17 and were heading to see an R-rated movie. You (the client) are stopped by the usher (the server) who requests proof of your age, and you show him your ID (client certificate). The usher is suspicious, so he asks you to tell him your astrological sign (the challenge) to prove yourself. You answer correctly (the solution) and are given a ticket (the token) to the movie.<\/p>

    A more technical breakdown:<\/p>

    1. The client presents a certificate to the server<\/li>
    2. The server confirms that the certificate is valid and trusted and stores it<\/li>
    3. The server sends back a challenge for the client to solve (related to the client certificate)<\/li>
    4. The client sends back the solution to the challenge to the server<\/li>
    5. The server checks the solution and if it is accepted, issues the client a token<\/li>
    6. The client uses this token with all subsequent calls made to the server<\/li><\/ol>

      To avoid confusion, let’s define the terms certificate, challenge, solution, and token:<\/p>