AFAIK we must install the client-certificate into the users browser to connect with https-sites using server-certificates to have a mutual authentication.

What about AJAX and JSON, can we connect to the server without installing the client-certificate into the browser?

In example the .cer file will be available from the webspace and NOT installed into the browser.

  • 2
    how will the client be able to trust that the cer is actually from your server (rather than a DNS-spoofed copy)? just get a properly signed cert – ratchet freak Oct 8 '14 at 14:14
  • Like a man-in-the-middle-attack? Good point. Noone can say the client-certificate is downloaded by the man-in-the-middle... – Peter Rader Oct 8 '14 at 14:17
  • your question is really confusing. Could you elaborate? – tom Oct 9 '14 at 10:32
  • @tom what is confusing you? – Peter Rader Oct 9 '14 at 10:47
  • You appear to be asking if you can have client authentication for "application/json" requests but not "text/html" ones... on the same server. But that doesn't make much sense. I'm not sure what you mean by "In example the .cer file will be available from the webspace" – tom Oct 9 '14 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.