Client Certificate

A client certificate is a certificate that a client presents during the TLS handshake to prove its own identity to the server. In ordinary HTTPS only the server shows a certificate; client certificates add authentication in the other direction.

Why it matters

Passwords and API keys can be copied or phished. A client certificate is tied to a private key that never leaves the device, and the server checks the certificate against a CA it trusts. That makes it common for service-to-service traffic, VPN gateways, device fleets and high-security admin panels. When both sides present certificates, the setup is called mutual TLS. Operationally the cost is lifecycle work: issuing, distributing, renewing and revoking certificates for every client.

Example

An nginx server that requires a valid client certificate:

ssl_client_certificate /etc/nginx/clients-ca.pem;
ssl_verify_client on;

A client without a certificate signed by that CA fails the handshake, commonly with 400 No required SSL certificate was sent. You can test from the command line with curl --cert client.pem --key client.key https://example.com.

Common mistakes

• Letting client certificates expire silently and locking out automated jobs.
• Trusting any CA the server already knows, instead of a dedicated private CA for clients.
• Having no revocation plan for lost laptops or leaked keys.

Related

• Mutual TLS
• TLS handshake
• Certificate authority
• Private key

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.