Employee-facing Mutual TLS. Armen Tashjian | Security Engineer… | by Pinterest Engineering | Pinterest Engineering Blog | Medium

This blog article is the second part of our recently released blog: Enforcing Device AuthN & Compliance at Pinterest. As part of our device authentication and compliance initiative, Pinterest has implemented employee-facing mutual TLS with a custom identity provider in a way that results in a positive user experience. You may have heard of, or experienced first hand, some unpleasant behavior while attempting to authenticate with a certificate within a browser or application. Even the Wikipedia page for mutual TLS mentions that mTLS is a “..less user-friendly experience, [and] it’s rarely used in end-user applications…”. At Pinterest, we needed to use Mutual TLS as part of our employee SSO authentication, using a custom identity provider. This means that we needed to support authentication across all major platforms, as well as from within browsers and native applications. In this blog post, we’ll talk about some of the changes that we’ve made to ensure that user-facing mTLS is a seamle

This blog article is the second part of our recently released blog: Enforcing Device AuthN & Compliance at Pinterest. As part of our device authentication and compliance initiative, Pinterest has implemented employee-facing mutual TLS with a custom identity provider in a way that results in a positive user experience. You may have heard of, or experienced first hand, some unpleasant behavior while attempting to authenticate with a certificate within a browser or application. Even the Wikipedia page for mutual TLS mentions that mTLS is a “..less user-friendly experience, [and] it’s rarely used