# User certificates instead of passwords?

**URL:** <https://openziti.discourse.group/t/user-certificates-instead-of-passwords/275>\
**Category:** Uncategorized\
**Created:** [February 23, 2022, 5:44pm UTC](https://openziti.discourse.group/t/user-certificates-instead-of-passwords/275 "2022-02-23T17:44:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\
**Post date:** [February 23, 2022, 5:44pm UTC](https://openziti.discourse.group/t/user-certificates-instead-of-passwords/275/1 "2022-02-23T17:44:28Z")

</div>

How do I issue a user certificate for the default admin user? I believe I can then use that certificate to login to the management API instead of a password.

Additionally, is there a way to disable password authentication and therefore require either:

1. a user certificate, or
2. an expiring session token?

If I understand correctly, this means I can use either a certificate or a password to obtain the session token for the management API and potentially share that token with another process by way of delegating temporary authority to act on my behalf, and that process will not need either the password nor certificate to use the session token until it expires.

---

<div class="post-metadata">

**Author:** ![andrew.martinez](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/andrew.martinez/32/540_2.png) [@andrew.martinez](https://openziti.discourse.group/u/andrew.martinez)\
**Post date:** [March 2, 2022, 2:37pm UTC](https://openziti.discourse.group/t/user-certificates-instead-of-passwords/275/2 "2022-03-02T14:37:53Z")

</div>

The Management API allows for the creation of authenticators directly.

You should be able to do:

```auto
POST /edge/management/v1/authenticators/
{
    "method": "cert",
    "identityId": "qNYyfJgHk>",
    "certPem": "-----BEGIN CERTIFICATE-----\n..."
}

```

Where `certPem` is a client certificate that has been signed by a known CA (1st or 3rd party). After ensuring the authenticator works, the password authenticator can be deleted via:

`DELETE /authenticators/{id}`