The difference between a client and server SSL certificate

So what is the difference between client and server Secure Sockets Layer (SSL) certificates? Although client certificates and SSL server certificates both use certificates, they are not directly related to each other. SSL server certificates provide encryption and security functionality. Client certificates provide user authentication functionality. The client certificate identifies the user, the server certificate identifies the server.

Here is the technical difference between the two. The difference lies in the Certificate Extensions. The X.509 standard defines what information can go into a certificate, and describes how to write it down (the data format). X.509 Version 3 is the most recent (1996) and supports the notion of extensions.

This tech note by Mozilla describes the Certificate Extensions in detail. But here are the extensions which are necessary for a client certificate:

basicConstraints = CA:FALSE
nsCertType = client
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth

If you want to know how to create such a client certificate, see my last blog entry.

How to create a self-signed SSL client certificate

Here's how to create a self-signed SSL client certificate with openssl on the command line.
First we have to create the private key:
openssl genrsa -out client.key 2048
Now we can create certificate request. Enter all the distinguished name information required to create a certificate request using the following command:

openssl req -key client.key -new -out client.req


OpenSSL commands expect to receive a file named: client.cnf. This file stores information that help generate extension fields to the certificate. You must create the client.cnf file with the following information:

[ ssl_client ]
basicConstraints = CA:FALSE
nsCertType = client
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth

Create a certificate request into a self signed certificate using extensions for the client certifiacte:
openssl x509 -req -days 365 -in client.req -signkey client.key -out client.crt -extfile client.cnf -extensions ssl_client
Verify the certificate:
openssl x509 -text -noout -in client.crt
As you can see the SSL extensions are now part of the certificate:
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Cert Type:
SSL Client
X509v3 Key Usage:
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Client Authentication


Now you can test your SSL connection with the following command:
openssl s_client -connect localhost:443 -key client.key -cert client.crt