title: Apache Client Certificates for Authentication
body: <p>I want to expose a service via an API with two factors of authentication using PHP/MySQL.  One factor is a simple user name and password.  For the other factor, I am attempting to use mutual TLS, in which the client certificate is matched with the username.  I intend to use self-signed certificates from a CA I set up on a CentOS box with Apache and issue the client certificates to customers via a secure channel, along with the private keys.</p>
  
  <p>I found some decent articles on how to set up user authentication using SSL certificates.  The best I found so far is below.</p>
  
  <p><a href="https://cweiske.de/tagebuch/ssl-client-certificates.htm" rel="nofollow noreferrer">https://cweiske.de/tagebuch/ssl-client-certificates.htm</a></p>
  
  <p>But, there seems to be a hole this and the other articles in terms of explaining something to me.  How I envision this working is that when a POST request is made by the client, along with the user name and password, a certificate with a digital signature signed by the private key issued to the user is also included.  This signature can then be decrypted by the public key to confirm that the owner of the private key sent the message.  But, these articles don't actually confirm that this is what is happening.</p>
  
  <p>Instead, they say that Apache confirms the certificate was signed by the CA Cert.  They also explain how to use PHP to access the fields in the certificate, such as SSL_CLIENT_S_DN_Email and SSL_CLIENT_M_SERIAL, and use them to confirm the certificate belongs to the sender of the message.  But, it is not clear to me that they are not just using information in the public certificate.  So, anyone who can access the public certificate can then use it as one of the factors of authentication to authenticate to the service.  If so, this means it is not really a factor of authentication.</p>
  
  <p>Am I mistaken to think what I hope is the case - that the certificate included with the message does include a signature signed by the private key issued to the user and that Apache decrypts the signature with the public key rather than just confirm the certificate was issued by the CA?</p>