Question

I’m using client certificates in SSL sessions to authenticate users, but I’m having a bit of a problem with cached sessions. (I have configured IIS to accept—not require—client certificates.)

Normal situation:
A user accesses the page that asks for the certificate. The browser launches the certificate selector, the user selects the desired certificate (and enters a PIN if needed), and everything goes forward as it should.

Situation where things don’t work as expected:
A user accesses the page that asks for the certificate. The browser launches the certificate selector, and the user selects the desired certificate, but then cancels at the PIN dialog. The user is redirected to the previous page because no certificate was sent. The user tries to log in again, but the attempt automatically fails because the last SSL session was cached.

I solved this in IE using document.execCommand("ClearAuthenticationCache");, but it still doesn’t work in FF or Chrome because they don’t support the method. Is there any way to solve this?

Answer 1

You may be interested in this discussion and this Chromium issue. In particular, you should try:

if (window.crypto) window.crypto.logout();