Creating and installing one is more difficult than creating a server certificate because the client must generate a key-pair, keep the private key to itself, and send the public key to the certificate authority to be incorporated into a certificate request. Once a signed certificate has been created using the Certificate Authority, this client certificate must be installed in the client so that the client may present it when needed. Different clients such as Netscape Navigator and Microsoft Internet Explorer support different mechanisms for creating client certificates. User enters identification information. Private key is stored in browser.
Public key is sent with identification information to the server.
Server CGI script creates certificate and loads it into the client. The HTML form also contains information used to cause the browser to generate a key-pair, and a hidden field used to return this to the CGI script. This hidden information is browser dependent and the form is processed by a browser-dependent script. The server must have a server certificate installed, and the server's CA certificate must have been installed in the browser. The server will only request a client certificate from the browser if it is required in the server configuration file.