Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper presents a semester-long longitudinal study on the usability of mutual TLS (mTLS) with 46 computer science students configuring and using client certificates for authentication. The study found that initial setup is a significant usability bottleneck, and daily use did not improve long-term usability perceptions. Alarmingly, only 9% of participants fully grasped the security implications of certificate-based authentication, highlighting the challenges of mTLS adoption for non-PKI specialists.
Even highly technical computer science students struggle to understand and use mutual TLS, suggesting that current implementations are fundamentally misaligned with non-PKI specialists.
Mutual TLS (mTLS) provides strong, certificate-based authentication for both clients and servers, yet its adoption for user-facing websites remains rare. This paper presents a longitudinal study of mTLS usability, tracking 46 senior and graduate computer science students who configured client certificates from scratch, used them for routine authentication over a semester-long course, and managed credentials across multiple devices. The results reveal that initial setup is a major bottleneck; while daily use was considered smooth, it did not improve long-term usability perceptions. Most concerningly, only 9% of participants fully understood the security implications of certificate-based authentication. We conclude that in a realistic, tooling-heavy deployment utilizing OpenSSL, a custom CA, and a 3072-bit minimum key requirement, even highly technical students struggled significantly. We argue this provides empirical evidence that today mTLS user experience is fundamentally misaligned with non-PKI specialists, and it is difficult to see a path toward mainstream adoption without substantial platform-level changes.