Extension:SSLClientAuth

The SSLClientAuth extension replaces password authentication with the one based on client SSL certificates.

Conceptually it's the same as SSL authentication extension, but it has been written for modern (1.25) MediaWiki version and uses much less hacks.

The first time user tries to open the wiki with a valid client certificate, a new account with name specified in certificate's Common Name is created automatically. Account registration should probably be disabled, as no user can log in without a certificate anyway.

It has only been tested with nginx with PHP running in FastCGI mode, but it should be easy to add support for other servers, too.