# User Client Certificates

**URL:** <https://community.letsencrypt.org/t/user-client-certificates/100257>\
**Category:** Client dev\
**Created:** [August 20, 2019, 12:14am UTC](https://community.letsencrypt.org/t/user-client-certificates/100257 "2019-08-20T00:14:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ol2tmx](https://avatars.discourse-cdn.com/v4/letter/o/b5a626/32.png) [@ol2tmx](https://community.letsencrypt.org/u/ol2tmx)\
**Post date:** [August 20, 2019, 12:14am UTC](https://community.letsencrypt.org/t/user-client-certificates/100257/1 "2019-08-20T00:14:47Z")

</div>

I am wondering if Let’s Encrypt is supporting to create user client certificates for validation against a letsencrypt server certificate. In the past times I already used Certbot successfully for creation of server certificates. But I did not fin any hint in the documentation. I probably overseen it.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [August 20, 2019, 12:47am UTC](https://community.letsencrypt.org/t/user-client-certificates/100257/2 "2019-08-20T00:47:26Z")

</div>

Hi @ol2tmx,

Nope, Let’s Encrypt does not issue this kind of certificate at all.

[https://community.letsencrypt.org/search?q=%22client%20certificate%22](https://community.letsencrypt.org/search?q=%22client%20certificate%22)

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [August 20, 2019, 1:15am UTC](https://community.letsencrypt.org/t/user-client-certificates/100257/3 "2019-08-20T01:15:55Z")

</div>

I should add that Let’s Encrypt certificates _can_ be used for client authentication, but the subject of the certificate must be a DNS domain name and can’t be any other kind of entity. So they could be used to perform authentication of one computer to another computer, if the authenticating computer is identified by a DNS domain name.

For authenticating _people_, you can potentially issue your own client certificates directly if you have a prior basis for ground truth. Client certificates don’t have to be publicly trusted, so you can create your own authority to issue these certificates and then confirm that a client certificate you receive was issued by your authority. For example, you can use a client certificate that you issue as an alternative to, or a supplement to, a user’s password.

What Let’s Encrypt can’t do, that other certificate authorities might be in a position to do, is issue a certificate confirming a person’s legal identity or a person’s control over a specific e-mail address.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 19, 2019, 1:25am UTC](https://community.letsencrypt.org/t/user-client-certificates/100257/4 "2019-09-19T01:25:53Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.