Is the use of digital certificates with passwords considered two-factor authentication?

The answer to that question depends on who you ask. Information security professionals and regulators have different views on this.

The traditional definition of two-factor authentication in information security textbooks revolves around three authentication factors: something you know, something you have and something you are. Something you know is a memorized secret credential, like a user ID and password. Something you have is an tangible object, like a one-time password (OTP) token or smart card that holds authentication credentials. Something you are represents a physical characteristic unique to yourself, like a fingerprint or face pattern, which can only be measured by a biometric device.

Two-factor authentication is a combination of any two of these factors. A digital certificate by itself wouldn't be considered the second factor in a two-factor system because the certificate itself isn't a factor. It isn't something the user knows or has. It's passive because it's sent behind the scenes when a user logs in.

If the certificate sits on a smart card or OTP token, then the token is the second factor in the system. The certificate just validates the device. It's not a true authentication credential by itself.

The definitions get blurry in a guidance issued by the Federal Financial Institutions Examination Council (FFIEC) in 2005. The FFIEC recommended that bank Web sites be protected while conducting transactions with two-factor authentication. The guidance used the traditional definition of two-factor authentication, but mentioned that the use of digital certificates was acceptable in some circumstances. Acceptable circumstances include a digital certificate on a USB token for authentication purposes and digital certificates used for mutual authentication in SSL on Web sites.

Either way, a digital certificate, alone or on a device, doesn't constitute two-factor authentication. It's the device holding the certificate that makes the authentication two-factor.