There&#x27;s another advantage to SSL client certificates that this article doesn&#x27;t mention: it allows the <i>server</i> to know that the connection isn&#x27;t being intercepted by an attacker.<p>With passwords or even many 2FA solutions, an attacker can just replay them to the server, and the server has no way to know that they&#x27;re not coming directly from the client. But SSL client certificates cannot be replayed by the attacker, so if the server receives a valid connection with a SSL client certificate, it knows that it could only have come from a client with the corresponding private key.<p>There are proposals to also be able to authenticate the client in a non-replayable way with passwords (like TLS-SRP), but AFAIK they haven&#x27;t been implemented in any browser.