---
title: "Certificate authentication"
description: "Authenticating users with X.509 public key certificates: generate a nonce, have the user sign it, verify the signature and validate the certificate."
canonical: "https://docs.lacunasoftware.com/en-us/articles/pki-guide/cert-auth"
locale: "en"
product: "PKI guide"
last_updated: "2026-10-12"
---

# Certificate authentication

It is possible to authenticate users based on their X.509 public key certificates. This process is roughly outlined
below:

1. Generate a [cryptographic nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce)
1. Ask the user to perform a signature algorithm computation on the nonce using his private key
1. Verify the nonce signature with the user certificate's public key
1. Validate the user's certificate
1. If everything checks out, the application can trust that the user is indeed the subject of the certificate. Then,
   based on a key information on the certificate (e.g.: email address or ID number), locate the user on the database and
   complete the sign-in process

> **Note**
>
> This is merely an overview. There are extra steps involved, such as validating that the nonce has never
> been used before in order to prevent replay attacks.

To implement this process, you need to perform operations on both the front- and backend:

The signature algorithm computation over the nonce must necessarily be done on the **frontend** because the user
certificate's private key might be on a cryptographic device that never allows exporting it. Moreover, even if the
private key is software-based, it is a bad practice to ask the user for it.

The generation of the nonce and all validations must be done on the **backend**, for obvious security reasons.

**The recommended way of implementing certificate authentication is using [Rest PKI Core](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core)** together with [Web PKI](https://docs.lacunasoftware.com/en-us/articles/web-pki).
Rest PKI Core generates the nonce and does all the validations, including the check against replay attacks.

## Recommended steps

1. Follow [Get started](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/get-started) on the Rest PKI Core documentation: get the endpoint and an API key, and add
   the client library for your language
1. Read [Certificate authentication](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/cert-auth) on the Rest PKI Core documentation
1. Run the Java sample, [AuthenticationRestPkiCoreController.java](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/java/springmvc/src/main/java/com/lacunasoftware/pkisuite/controller/AuthenticationRestPkiCoreController.java),
   from the PkiSuiteSamples project

> **Tip**
>
> Although the solution involves both Rest PKI Core and Web PKI (for the back- and frontend respectively), you should
> **focus on the Rest PKI Core documentation**, which shows the usage of both products integrated.

## Alternative implementations

If your application is a .NET application (C#, VB.NET, C++.NET), you can also use the [PKI SDK](https://docs.lacunasoftware.com/en-us/articles/pki-sdk)
on the backend with Web PKI on the frontend. See article [Certificate authentication](https://docs.lacunasoftware.com/en-us/articles/pki-sdk/certificates/auth).

If your backend runs on your own Windows or Linux servers, you can also use [PKI Express](https://docs.lacunasoftware.com/en-us/articles/pki-express) on the backend with Web PKI on
the frontend. See article [Certificate authentication](https://docs.lacunasoftware.com/en-us/articles/pki-express/authentication) on the PKI Express documentation.

If you already own a 3rd party crypto SDK or if you wish to implement the backend code yourself, you can also use
[Web PKI](https://docs.lacunasoftware.com/en-us/articles/web-pki) just for the frontend part.

Applications already integrated with [Rest PKI](https://docs.lacunasoftware.com/en-us/articles/rest-pki), a legacy product that still receives bug and security fixes, can keep
following its article [Certificate authentication](https://docs.lacunasoftware.com/en-us/articles/rest-pki/certificate-authentication). To move one to Rest PKI Core, see
[Moving from Rest PKI to Rest PKI Core](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/migrating-from-rest-pki).