1. FAQ
  2. Public Trust and Certificates
  3. What’s the Difference Between Client Certificates vs. Server Certificates?
FAQ Hero
Public Trust & Certificates

What is the difference
between client and
server certificates?

What’s the difference between client certificates vs. server certificates?

Client certificates are digital certificates for users and individuals to prove their identity to a server. Client certificates tend to be used within private organizations to authenticate requests to remote servers. Whereas server certificates are more commonly known as TLS/SSL certificates and are used to protect servers and web domains. Server certificates perform a very similar role to Client certificates, except the latter is used to identify the client/individual and the former authenticates the owner of the site.

What is a client certificate?

Client certificates are, as the name indicates, used to identify a client or a user, authenticating the client to the server and establishing precisely who they are. To some, the mention of PKI or ‘Client certificates’ may conjure up images of businesses protecting and completing their customers’ online transactions, yet such certificates are found throughout our daily lives, in any number of flavors; when we sign into a VPN, use a bank card at an ATM, or a card to gain access to a building or within public transport smart cards. These digital certificates are even found in petrol pumps, the robots on car assembly lines and even in our passports.

In Continental Europe and in many other countries, the use of client certificates is particularly widespread, with governments issuing ID cards that have multiple uses, such as to pay local taxes, electricity bills and for drivers’ licenses. And the reason why is simple—client certificates play a vital role in ensuring people are safe online.

What is a server certificate?

Server certificates typically are issued to hostnames, which could be a machine name (such as ‘XYZ-SERVER-01’) or domain name (such as ‘www.digicert.com’). A web browser reaching the server validates that the TLS/SSL server certificate is authentic. That tells the user that their interaction with the website has no eavesdroppers, and that the website is representing exactly who they claim they are. This security is critical for electronic commerce, which is why certificates are now in such widespread use.

How do server certificates and client certificates work together to keep you secure online?

In practice, a website owner obtains a server certificate by applying to a certificate provider like DigiCert with a certificate signing request (CSR). This is an electronic document that contains all the essential information: website name, contact email address and company information.

The certificate provider signs the request, producing a public certificate, which is served to any web browser that connects to the website and, crucially, proves to the web browser that the provider issued a certificate to the person he believes to be the owner of the website. Before issuing a certificate, however, the certificate provider will request the contact email address for the website from a public domain name registrar and check that published address against the email address supplied in the certificate request, ensuring the circle of trust has been closed.

Moreover, you can configure a website so that any user wishing to connect is required to provide a valid client certificate, and valid username and password. This is usually referred to as ‘two-factor authentication’ – in this instance, ’something you know’ (password) and ’something you have’ (certificate).

For those engaged in transactions on the web, certificates mean an end to anonymity and instead provide assurance that you can trust the websites you’re interacting with online. In a digital world where our security is being continually challenged, such reassurance is invaluable.

  • DigiCert Logo

    The most-trusted global provider of high-assurance TLS/SSL, PKI, IoT and signing solutions.