0

AFAIK we must install the client-certificate into the users browser to connect with https-sites using server-certificates to have a mutual authentication.

What about AJAX and JSON, can we connect to the server without installing the client-certificate into the browser?

In example the .cer file will be available from the webspace and NOT installed into the browser.

Improve this question
8
  • 2
    how will the client be able to trust that the cer is actually from your server (rather than a DNS-spoofed copy)? just get a properly signed cert
    – ratchet freak
    Oct 8, 2014 at 14:14
  • Like a man-in-the-middle-attack? Good point. Noone can say the client-certificate is downloaded by the man-in-the-middle...
    – Grim
    Oct 8, 2014 at 14:17
  • your question is really confusing. Could you elaborate?
    – tom
    Oct 9, 2014 at 10:32
  • @tom what is confusing you?
    – Grim
    Oct 9, 2014 at 10:47
  • You appear to be asking if you can have client authentication for "application/json" requests but not "text/html" ones... on the same server. But that doesn't make much sense. I'm not sure what you mean by "In example the .cer file will be available from the webspace"
    – tom
    Oct 9, 2014 at 11:10

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.