A utility is evaluating certificate-based user authentication as an alternative to password-based login for a set of engineering laptops accessing the control-center network. Conceptually, what does this approach rely on instead of a shared password?
Select an answer to reveal the explanation.
Short Explanation
A certificate does for authentication what a signed ID badge does in the physical world — it proves who issued it and who's carrying it, without anyone needing to memorize a shared word. The engineer's laptop holds a private key nobody else has, and the FortiGate trusts a certificate signed by an authority it already trusts. No password gets typed or shared at all.
Full Explanation
Certificate-based user authentication relies on public-key cryptography: the user or their device holds a client certificate and its corresponding private key, issued and signed by a certificate authority the FortiGate is configured to trust, and the authentication exchange proves possession of that private key rather than knowledge of a shared secret like a password. This is fundamentally different from a RADIUS-style shared secret, which is a symmetric value both sides must hold identically — certificate authentication instead relies on asymmetric keys and a trust chain back to a CA. It is also unrelated to one-time codes, which belong to token-based two-factor schemes and do not use a certificate or private key at all; conflating the two describes a different mechanism entirely. Storing a plaintext username on the laptop for the FortiGate to read would provide no actual proof of identity, since anyone with access to that file could claim to be that user — certificate authentication's strength specifically comes from the private key never leaving the holder's device. A caveat worth noting: this approach depends entirely on keeping the private key protected on the endpoint, since a stolen laptop with an unprotected key undermines the whole model. To verify, check that the CA certificate trusted by the FortiGate matches the one that issued the engineer's client certificate.