I use client certificates since they are required in my line of business and had the impression that they are only presented when asked for by the website, only I explicitly allow it.
Other than the sites that I know require them, I have never been asked to choose a certificate when browsing random websites (windows 11).
Oh, they're not always presented when asked! That'd be one hell of a privacy risk. I think there's a setting for IE/Edge that'll automatically present them for intranet websites, but public websites will prompt you first (unless you dig into the registry and override this behaviour).
Maybe the situation changed, or ad blockers have become better in the mean time, but last time I used them in Firefox, I was bombarded by client certificate requests browsing around the web.
The problem I have with the UX is that the certificate selection screen is a modal dialog that any URL seems to be able to bring up, and I found this abused in the wild. This, combined what made with the countless requests, made me move away from using them.
Another issue I struggled with was that every now and then I'd pick the wrong certificate and I couldn't for the life of me figure out how to correct this without restarting my browser and losing all my work. Switching between accounts for cert based auth was plain impossible.
Lastly there was the entirely unhelpful error state you can end up with when using client certs. Vague HTTPS errors that come down to "oh no something went wrong try reloading I guess" and weird side effect when certificates expired (from browsers sending old certificates to servers accepting expired certificates). The errors occur in the TLS layer, so you end up with authentication errors thst seemingly end up being handled as connection issues.
If you say these issues have been resolved, I should probably give mTLS another go.
FWIW I don’t use FF on the machine where I have the certificates installed, and before I setup network adblockers, had only clienside ones in chrome, and used edge mostly for the sites that needed them, for the past several years.
The UI can be clunky, especially if you set up the certificates to be stored in TPM, since then windows sometimes pops up the dialog in a way that’s easy to miss. Other than that Ive no complaints. Good luck!
I use client certificates since they are required in my line of business and had the impression that they are only presented when asked for by the website, only I explicitly allow it.
Other than the sites that I know require them, I have never been asked to choose a certificate when browsing random websites (windows 11).