--- title: 7 Best Practices for Certificate-Based Authentication description: Certificate-based authentication offers stronger security than passwords or static keys but carries risks like forged certificates, stolen certificate reuse,... canonical: https://daily.dev/posts/7-best-practices-for-certificate-based-authentication-bs7b5pws5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 7 Best Practices for Certificate-Based Authentication | daily.dev og:description: Certificate-based authentication offers stronger security than passwords or static keys but carries risks like forged certificates, stolen certificate reuse,... og:url: https://daily.dev/posts/7-best-practices-for-certificate-based-authentication-bs7b5pws5 og:image: https://api.daily.dev/og/posts/bs7B5pwS5.png og:image:alt: 7 Best Practices for Certificate-Based Authentication og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 7 Best Practices for Certificate-Based Authentication **[Teleport](https://daily.dev/sources/teleport)** · 9 min read · 0 upvotes · 0 comments ## Summary Certificate-based authentication offers stronger security than passwords or static keys but carries risks like forged certificates, stolen certificate reuse, compromised CAs, and misconfigured verification. Seven best practices are outlined: use vetted cryptography (avoid MD5/SHA-1 due to collision attacks like the Flame malware exploit), implement full certificate verification with scoped attributes, test the authentication logic (citing a Dovecot bypass bug), protect CA keys ideally in an HSM, separate CAs for users and servers, issue short-lived certificates to limit breach exposure, and periodically rotate the CA using a phased approach (standby, init, update_clients, update_servers, rollback) as implemented in Teleport. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why should MD5 or SHA-1 be avoided in certificate signing? MD5 and SHA-1 are vulnerable to collision attacks, where two different inputs produce the same hash value, allowing forged certificates. Researchers demonstrated a proof of concept creating a rogue Certificate Authority trusted by most web browsers by exploiting MD5 weaknesses, and Flame malware exploited an MD5 collision to generate rogue certificates derived from a trusted Microsoft CA. _Teams hardening certificate signing pipelines can track cryptography guidance like this on daily.dev._ ### What was the Dovecot certificate authentication bypass vulnerability? Dovecot's certificate-based authentication only allowed the username assigned in the x500UniqueIdentifier field to log in, but removing that field entirely bypassed the authentication model, letting an attacker log in as any user. The issue illustrates how a misconfigured verification method can silently break certificate-based auth, underscoring the need to audit authentication logic after implementation. _Developers auditing auth flows for edge cases like this follow security writeups on daily.dev._ ### What are the phases of automated CA rotation in Teleport? Teleport's CA rotation moves through five phases: standby (no rotation active), init (new CA issued but unused, trusted clusters fetch it), update_clients (client certs updated while servers still use old credentials), update_servers (servers switch to new CA but still accept old certificates), and rollback (aborts and reverts to the old CA). This phased approach avoids downtime during rotation. _Infrastructure teams planning CA rotation strategies can find implementation details like this on daily.dev._ ## Similar posts on daily.dev - [Enabling and Securing Basic Authentication: A Comprehensive Guide](https://daily.dev/posts/enabling-and-securing-basic-authentication-a-comprehensive-guide-ymsvhnb9y) · Security Boulevard · 0 upvotes · 0 comments - [Public Key Authentication: What It Is and How It Works](https://daily.dev/posts/public-key-authentication-what-it-is-and-how-it-works-1oenthewx) · Descope · 1 upvotes · 0 comments - [Jan-Piet Mens :: SSH certificates: the better SSH experience](https://daily.dev/posts/jan-piet-mens-ssh-certificates-the-better-ssh-experience-f1ftumowi) · Jan-Piet Mens · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#cryptography](https://daily.dev/tags/cryptography), [#pki](https://daily.dev/tags/pki) [View this post on daily.dev](https://daily.dev/posts/7-best-practices-for-certificate-based-authentication-bs7b5pws5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"7 Best Practices for Certificate-Based Authentication","url":"https://daily.dev/posts/7-best-practices-for-certificate-based-authentication-bs7b5pws5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/7-best-practices-for-certificate-based-authentication-bs7b5pws5"},"datePublished":"2026-08-23T12:23:24.365Z","dateModified":"2026-08-23T12:54:22.338Z","description":"Certificate-based authentication offers stronger security than passwords or static keys but carries risks like forged certificates, stolen certificate reuse,...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/7-best-practices-for-certificate-based-authentication-bs7b5pws5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,cryptography,pki","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"7 Best Practices for Certificate-Based Authentication"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/7-best-practices-for-certificate-based-authentication-bs7b5pws5#faq","mainEntity":[{"@type":"Question","name":"Why should MD5 or SHA-1 be avoided in certificate signing?","acceptedAnswer":{"@type":"Answer","text":"MD5 and SHA-1 are vulnerable to collision attacks, where two different inputs produce the same hash value, allowing forged certificates. Researchers demonstrated a proof of concept creating a rogue Certificate Authority trusted by most web browsers by exploiting MD5 weaknesses, and Flame malware exploited an MD5 collision to generate rogue certificates derived from a trusted Microsoft CA. Teams hardening certificate signing pipelines can track cryptography guidance like this on daily.dev."}},{"@type":"Question","name":"What was the Dovecot certificate authentication bypass vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Dovecot's certificate-based authentication only allowed the username assigned in the x500UniqueIdentifier field to log in, but removing that field entirely bypassed the authentication model, letting an attacker log in as any user. The issue illustrates how a misconfigured verification method can silently break certificate-based auth, underscoring the need to audit authentication logic after implementation. Developers auditing auth flows for edge cases like this follow security writeups on daily.dev."}},{"@type":"Question","name":"What are the phases of automated CA rotation in Teleport?","acceptedAnswer":{"@type":"Answer","text":"Teleport's CA rotation moves through five phases: standby (no rotation active), init (new CA issued but unused, trusted clusters fetch it), update_clients (client certs updated while servers still use old credentials), update_servers (servers switch to new CA but still accept old certificates), and rollback (aborts and reverts to the old CA). This phased approach avoids downtime during rotation. Infrastructure teams planning CA rotation strategies can find implementation details like this on daily.dev."}}]} ```