Client Certificate

Overview

Meaning and scope

A client certificate is an X.509 digital certificate presented by a client during a TLS connection so the server can authenticate the calling system, device, or organization. It is commonly used in mutual TLS for machine-to-machine payment APIs. A compromise response for Client Certificate should support rapid revocation, replacement, affected-client identification, and review of prior use.

Mechanism and operation

A client certificate is a digital certificate presented by client software to authenticate itself to a server, often during a mutual TLS handshake. The server checks the certificate chain, validity, usage constraints and its authorization mapping before accepting the connection. Possessing a trusted certificate can prove control of a private key but does not by itself grant permission to perform every API operation. Security depends on protecting the client private key, provisioning trust anchors and revoking or rotating compromised credentials. Expiring certificates can cause abrupt integration failures, so operators should manage renewal without disabling certificate checks or exposing keys in application logs.

Practical payment example

A payment integration rotates its mutual-TLS client certificate ahead of expiry and tests the updated trust chain in staging.

Operational checks

Track certificate issuer, subject and allowed identity, fingerprint, issuance and expiry, trust store, rotation overlap, revoked certificates and each environment’s permissions. The main risks include expired or revoked certificates, incorrect hostname or identity mapping, leaked private keys, weak enrollment controls, and outages caused by uncoordinated rotation. For Client Certificate, secrets and tokens should remain outside browser bundles, URLs, ordinary logs, and unprotected configuration. In production, teams should define ownership and apply trusted certificate authorities, certificate-chain validation, private-key protection, rotation, revocation checks, and environment-specific trust stores. It is different from an API key because possession of the private key is proven during the TLS handshake rather than by sending a reusable secret in an application header.

Distinctions and limits

A client certificate authenticates a machine or service identity; fine-grained authorization still requires separate policy decisions.

Related reading

Related definitions: Payment API Authentication, Dedicated RPC Endpoint.