Client Certificates

Updated Oct 15, 2026

A client certificate is a small digital ID card that lives on a person's computer or phone. A site protected with client certificates recognizes the ID automatically, so there's no password to type: people on a trusted device walk straight in, and everyone else sees the login page or gets turned away.

It's the same idea as the padlock icon, but pointing the other direction. The padlock proves the site is genuine; a client certificate proves the visitor is.

Why bother

• No passwords to share, lose or guess. A stolen password works from anywhere. A client certificate only works from the device it was installed on.
• Revoke one device without touching anyone else. Lost a laptop? Revoke its certificate and that one device stops working immediately.
• Your apps can know who's visiting. RustProxy can pass the verified name along to the site behind it so the app can skip its own login.

Where the certificates come from

RustProxy works with TrustBridge, JPPS's certificate service. You connect your RustProxy to your TrustBridge organization once, and then you can issue and revoke certificates without leaving the admin panel.

1. Open System and go to Client certificates.
2. Enter your TrustBridge organization token (it's saved, never shown again).
3. The page shows your plan and how many certificates you've used.

Issuing a certificate

1. On the Client certificates page choose Issue certificate.
2. Enter a name for the person or device (this is the name sites will see).
3. Download the .p12 file and note its password. It's shown once and never stored, so save it right away.
4. On the person's device, open the .p12 file and enter the password to install it. Browsers on phones and computers will then offer it when a protected site asks.

Protecting a site with them

1. In the Access lists tab create a list of type Client certificate.
2. Add the names allowed to use it. A client-certificate list with no names lets nobody in, by design.
3. Select the list on the site (Hosts, Edit, Access control).

A visitor with an allowed certificate is let in without a login page. Anyone else falls back to the site's other protection (login or allowed networks) or is turned away.

Revoking a certificate

On the Client certificates page choose Revoke next to the certificate. It takes effect right away. RustProxy also checks with TrustBridge each time a certificate is used, so a certificate revoked from another place is caught too, and once a revocation has been seen, RustProxy remembers it even if the check later can't be reached.

Only certificates from your organization

Turn on Require my organization on the same page. Then only certificates issued by your organization work anywhere on this proxy. Older certificates that carry only a name, and certificates from anyone else's organization, are treated as if the visitor had no certificate at all.

Turn it off by removing the lock on the same page. The proxy keeps working either way; the lock just narrows who is trusted.

Related

• Protecting a Site: the other kinds of protection, and how they combine
• Blocking Visitors: block always beats a valid certificate
• Troubleshooting