One problem is that keygen is either deprecated or not supported. So you have to create the client cert on the server, then have the user download it (including private key). Or the client has to create a signing request and then upload it to the server, and then download the certificate.<p>Once that is done though, client certificates works pretty well, the browser will pop up a &quot;what certificate to use&quot; dialog when entering the web site. And the server (nginx) will send all the details like name, city etc to the web-server application.<p>Another problem vs passwords, is that the user has to copy or download the certificate to each computer device. And just like passwords, you need to have a process for identifying the user in case he lose the certificate&#x2F;key.