如果客户端未通过证书，https 连接的安全性如何

Question

We have a web server running on linux machine where we configured 'SSLVerifyClient' as 'require' in ssl.conf file.

Does this needs client who is utilizing the service from web browser(like firefox or chrome) needs a certificate.

If yes, then it is not possible to distribute client certificate to every user as there can be some thousands of users, how to overcome this problem.

If no, then how the data passed over network is secure? I know that certificate helps in encrypting data so that no one who don't have certificate can read data.

Please help me in clarifying my doubts

Answer 1

If you don't use client certificate, the https connection is still safe:

• Only the client and the server can read/write the content
• The identity of the server is assured by a certificate authority

Client certificate only give you client authentication in the beginning of the connection. To encrypt the data, the public key of the server is used in the beginning (See public key encryption).

If you identify the client with cookies set after login/password submit, it is still safe: you have identify the client.

Answer 2

When SSLVerifyClient is set to require, the client MUST pass a client certificate. You would generate these via OpenSSL, and sign them with a certificate authority that you install via SSLCACertificateFile.

How you distribute those certificates is an issue you'll have to solve yourself.