There&#x27;s one thing about client certs that people should be aware: They open up new security and privacy issues.<p>There have been a number of TLS protocol issues regarding client certificates that didn&#x27;t receive that much attention (Triple Handshake, SLOTH), because not that many people use clientcerts. That&#x27;s not really an argument against them, but it&#x27;s a hint that if we want to use them more widely things would probably need more scrunity in security analysis.<p>Another issue that worries me more: Client certificates can break privacy expectations. The reason is that the cert is not hidden from the traffic. This makes the traffic less privacy preserving than - let&#x27;s say - a simple password, because the password is hidden inside the TLS encryption stream, while the client certificate is not. I think users have a reasonable expectation that &quot;if I only surf HTTPS sites nobody sees any personally identifiable information from me, just the sites I&#x27;m surfing&quot;. Client certificates break this expectation.