X509v3 certificates can be restricted to specific uses. Some S/MIME certificates are restricted so that they can't be used for websites, but most are not.
Thawte no longer issues client certificates. My certificate from 2003 had a Cert Type" of "SSL CLient, S/MIME" indicating that they could be used for both email and for client certificates. My certificate from April 27, 2009 had only a single constraint, that it could not be used as a Certificate Authority.
Apple's iChat encryption certificate can only be used for SSL Client. You get this automatically if you are a me.com customer and enable secure iChat.
You may find that it is easiest to issue your own certificates. Many people do this and it works quite well. You will need to have the user load your own key as a CA.
A client certificate is typically only meaningful in the context a service who trusts it.
For example when a windows computer joins a domain, that client workstation generates a key pair (internally), and the domain controller signs it, and that signed pair (now becomes a cert, though not an X509 cert) and is used internally by windows. The cert is only meaningful to the domain controller.
Normally large organizations who run their own CA issue client certs to people who wan to use SSL auth to access secure sites.
The reason that client certificates are probably rare on the internet at large, is the revocation problem. For Thawte to issue you (personally) a client cert would mean that they would have to be responsible for managing revocation for it. In order for it to be cost effective, there would be a large number of certs out there; and they would constantly be being revoked, since individuals constantly individual security lapses.
发布评论
评论（2）
X509v3 证书可以限制为特定用途。某些 S/MIME 证书受到限制，因此无法用于网站，但大多数证书并非如此。
Thawte 不再颁发客户端证书。我 2003 年的证书的证书类型为“SSL 客户端、S/MIME”，表明它们可用于电子邮件和客户端证书。我 2009 年 4 月 27 日的证书只有一个约束，即它不能用作证书颁发机构。Apple
的 iChat 加密证书只能用于 SSL 客户端，如果您是 me.com 客户并启用安全 iChat，
您可能会发现颁发自己的证书是最简单的。执行此操作后，您将需要让用户加载您自己的密钥作为 CA。
X509v3 certificates can be restricted to specific uses. Some S/MIME certificates are restricted so that they can't be used for websites, but most are not.
Thawte no longer issues client certificates. My certificate from 2003 had a Cert Type" of "SSL CLient, S/MIME" indicating that they could be used for both email and for client certificates. My certificate from April 27, 2009 had only a single constraint, that it could not be used as a Certificate Authority.
Apple's iChat encryption certificate can only be used for SSL Client. You get this automatically if you are a me.com customer and enable secure iChat.
You may find that it is easiest to issue your own certificates. Many people do this and it works quite well. You will need to have the user load your own key as a CA.
客户端证书通常仅在信任它的服务上下文中才有意义。
例如，当 Windows 计算机加入域时，该客户端工作站生成一个密钥对（内部），域控制器对其进行签名，并且该签名对（现在成为证书，尽管不是 X509 证书）并由 Windows 内部使用。该证书仅对域控制器有意义。
通常，运行自己的 CA 的大型组织会向想要使用 SSL 身份验证访问安全站点的人员颁发客户端证书。
客户端证书在整个互联网上可能很少见的原因是吊销问题。对于 Thawte 向您（个人）颁发客户证书意味着他们必须负责管理其吊销。为了使其具有成本效益，需要有大量的证书；而且它们会不断地被撤销，因为个人不断地出现个人安全漏洞。
A client certificate is typically only meaningful in the context a service who trusts it.
For example when a windows computer joins a domain, that client workstation generates a key pair (internally), and the domain controller signs it, and that signed pair (now becomes a cert, though not an X509 cert) and is used internally by windows. The cert is only meaningful to the domain controller.
Normally large organizations who run their own CA issue client certs to people who wan to use SSL auth to access secure sites.
The reason that client certificates are probably rare on the internet at large, is the revocation problem. For Thawte to issue you (personally) a client cert would mean that they would have to be responsible for managing revocation for it. In order for it to be cost effective, there would be a large number of certs out there; and they would constantly be being revoked, since individuals constantly individual security lapses.