Client Authentication Stronghold Web Server supports client authentication with X.509 certificates. Client certificates are similar to server certificates, and they are currently the most reliable means of identifying users and restricting access. The current versions of Netscape Navigator and Microsoft Internet Explorer both support client certificates, and many minor browsers may soon follow suit. Until recently, most browsers only supported basic authentication, which relies on usernames and passwords to authenticate users. The primary disadvantage of basic authentication is that usernames and passwords can be communicated through unencrypted transactions, allowing eavesdroppers to obtain the authentication criteria and access restricted material.
Client certificates can also be password-protected, but only on the user's local host.
The browser prompts the user for a password to prevent others from using the client certificate, but the password does not enter the network. Client certificates issued by major CAs are designed to provide authentication that any secure server can accept. Stronghold recognizes certificates signed by Verisign and Thawte.