<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-certificate-based-authentication
description: >-
  Deploy and manage X.509 certificate-based authentication for users, devices,
  and services. Covers PKI architecture, certificate lifecycle management,
  mutual TLS (mTLS), smart card authentication, and revocation strategies
  including CRL and OCSP.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - pki
  - x509
  - mtls
  - smart-card
  - certificate-authentication
  - ocsp
  - crl
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1553.004"]
---

# Implementing Certificate-Based Authentication

## Overview

Certificate-based authentication replaces shared secrets with asymmetric
cryptography. Each entity holds a private key and presents a signed certificate
to prove identity. This eliminates password spray, credential stuffing, and
phishing of static credentials. This skill covers PKI design, certificate
issuance, mTLS enforcement, smart card integration, and revocation monitoring.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSSL 3.x | `apt install openssl` or `brew install openssl` |
| cfssl | `go install github.com/cloudflare/cfssl/cmd/...@latest` |
| step-cli | `brew install step` or binary from smallstep.com |
| Python 3.10+ | For agent tooling |
| certifi | `pip install cryptography pyOpenSSL` |

## Key Concepts

### PKI Architecture

A minimal production PKI uses a three-tier model:

```
Root CA (offline, air-gapped)
  └── Intermediate CA (issuing, online)
        ├── Server certificates (TLS endpoints)
        ├── Client certificates (user/device auth)
        └── Service certificates (mTLS between services)
```

**Root CA** — generated offline, stored in HSM or encrypted USB. Signs only
intermediate CA certificates. 10-20 year validity.

**Intermediate CA** — signs end-entity certificates. 3-5 year validity.
Revocable without replacing root trust anchors.

### Certificate Profiles

| Profile | Key Usage | Extended Key Usage | Validity |
|---|---|---|---|
| Server TLS | digitalSignature, keyEncipherment | serverAuth | 90-398 days |
| Client Auth | digitalSignature | clientAuth | 1-2 years |
| mTLS Service | digitalSignature, keyEncipherment | serverAuth, clientAuth | 90 days |
| Smart Card | digitalSignature, keyEncipherment | clientAuth, smartcardLogon | 1-3 years |
| Code Signing | digitalSignature | codeSigning | 1-3 years |

### Certificate Issuance with step-ca

```bash
# Initialize CA
step ca init --name="NERF PKI" --dns="ca.internal" \
  --address=":8443" --provisioner="admin"

# Issue client certificate
step ca certificate "alice@corp.example" alice.crt alice.key \
  --provisioner="admin" --not-after=8760h

# Issue server certificate with SANs
step ca certificate "api.internal" server.crt server.key \
  --san="api.internal" --san="10.0.1.50" --not-after=2160h

# Renew before expiry
step ca renew server.crt server.key --force
```

### Mutual TLS Configuration

#### Nginx mTLS

```nginx
server {
    listen 443 ssl;
    ssl_certificate     /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;
    ssl_client_certificate /etc/nginx/certs/ca-chain.pem;
    ssl_verify_client on;
    ssl_verify_depth 2;
    ssl_crl /etc/nginx/certs/crl.pem;

    location / {
        proxy_set_header X-Client-CN $ssl_client_s_dn_cn;
        proxy_set_header X-Client-Serial $ssl_client_serial;
        proxy_pass http://backend;
    }
}
```

#### Go mTLS Client

```go
cert, _ := tls.LoadX509KeyPair("client.crt", "client.key")
caCert, _ := os.ReadFile("ca-chain.pem")
pool := x509.NewCertPool()
pool.AppendCertsFromPEM(caCert)
client := &http.Client{
    Transport: &http.Transport{
        TLSClientConfig: &tls.Config{
            Certificates: []tls.Certificate{cert},
            RootCAs:      pool,
        },
    },
}
```

### Revocation Strategies

| Method | Latency | Availability | Privacy |
|---|---|---|---|
| CRL | Minutes-hours | Cached offline | Leaks access patterns to CA |
| OCSP | Real-time | Requires CA uptime | Leaks access patterns to CA |
| OCSP Stapling | Real-time | Server caches response | No client-CA contact |
| Short-lived certs | N/A (no revocation) | No CRL/OCSP needed | Best privacy |

**Recommendation**: Short-lived certificates (24-72h) with automated renewal
eliminate revocation infrastructure entirely. Use step-ca with ACME for
automated issuance.

### Smart Card / PIV Authentication

```bash
# List PIV slots
yubico-piv-tool -a status

# Generate key in slot 9a (authentication)
yubico-piv-tool -s 9a -a generate -A RSA2048 -o pubkey.pem

# Import signed certificate
yubico-piv-tool -s 9a -a import-certificate -i client.crt

# Test PKCS#11 authentication
pkcs11-tool --module /usr/lib/libykcs11.so --login --test
```

## Workflow

1. **Design PKI** — Define trust hierarchy, certificate profiles, validity periods
2. **Deploy CA** — Initialize root (offline) and intermediate (online) CAs
3. **Issue certificates** — Generate and distribute client/server/service certs
4. **Configure endpoints** — Enable mTLS on load balancers, API gateways, services
5. **Automate renewal** — ACME protocol or step-ca renewal daemon
6. **Monitor expiry** — Alert on certificates expiring within 30 days
7. **Enforce revocation** — CRL distribution or OCSP stapling; prefer short-lived certs
8. **Audit** — Log all issuance, renewal, and revocation events

## Detection

```yaml
title: Certificate Based Authentication Detection
id: 8048aea6-8759-455c-95c3-63c0c35b72dd
status: experimental
description: Detects suspicious activity related to implementing certificate based authentication techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1553.004
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

| Check | Method |
|---|---|
| Certificate chain valid | `openssl verify -CAfile ca-chain.pem server.crt` |
| mTLS handshake succeeds | `curl --cert client.crt --key client.key https://api.internal` |
| CRL is current | `openssl crl -in crl.pem -noout -lastupdate -nextupdate` |
| OCSP response valid | `openssl ocsp -issuer ca.crt -cert server.crt -url http://ocsp.internal` |
| Certificate not expired | `openssl x509 -in cert.pem -noout -enddate` |
| Key usage correct | `openssl x509 -in cert.pem -noout -text | grep -A2 "Key Usage"` |

## References

- [Smallstep step-ca Documentation](https://smallstep.com/docs/step-ca/)
- [NIST SP 800-57 Key Management](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final)
- [RFC 5280 — X.509 PKI Certificate Profile](https://datatracker.ietf.org/doc/html/rfc5280)
- [MITRE ATT&CK T1553 — Subvert Trust Controls](https://attack.mitre.org/techniques/T1553/)
