0
$\begingroup$

So I am registering users and I need to know they really are who they say they are. More importantly that they represent the company they say they represent.

I was told I can ask them to send me a verisign (or similar) certificate. Basically the company (the more reputable ones) emiting certificates are meant to have already made sure that person is who he says he is and/or really works for Company X Inc.

So when a user fills in his registration form, I ask for an email address, name, company name,etc. and I also ask for this certificate to be uploaded (with a short list of the actual certificates I will accept, e.g. Verisign Pro EV.)

So how do I then use this file to verify that the certificate is valid?

$\endgroup$
  • 1
    $\begingroup$ You don't. You have to run some (automated) protocol with them that they didn't just copy the certificate but rather posses the associated private key (answer to follow). $\endgroup$ – SEJPM Mar 27 '17 at 18:10
3
$\begingroup$

Ok, I'll assume you have collected the data from the form. The next step is to confirm the user's identities based on the certificates they have. For this you have two options:

  • Send a S/MIME signed email to you which includes a chosen-by-you challenge in the message body. For this you could randomly generate a new email adress for each user so you can distinguish them if two happen to share some information. Also make sure that this random email address is in the message body because only that gets signed. Once you receive the email, you verify the certificate signatures, verify the root CA and the intermediates, verify the signature on the mail and verify the information in the certificat against what you had on the form for this specific person. If everything passes this person is confirmed. This assumes the user can use their certificate for e-mail signing.
  • Run a TLS client authentication. For this you'd give each user a random link when he has completed the form. Next he opens that link, the web-server will trigger a TLS client authentication and the TLS protocol will verify that the user has a) access to the private key of the certificate, b) will take care of all the signature verifications and whatnot and c) will verify that the cert chains up to a trusted root that you explicitely set up to accept for the client authentication. Following that your application-layer should get access to the client certificate information from your TLS implementation and need to verify that all the fields in the certificate match with the expected values from the form. This assumes the user's certificate is configured to be used with the browser which is (usually?) less common.

So how do I then use this file to verify that the certificate is valid?

You don't without interaction. The certificate was issued to the holder of the private key associated with the public key in the certificate. This person is guaranteed to be the person from the certificate. If you just have the certificate you don't know that the person uploading it is in possesion of the secret key and thus you don't know whether this is indeed the "legitimate owner" of the certificate, thus you need one of the above approaches (which both shouldn't be too hard to implement).

$\endgroup$
  • $\begingroup$ Thanks for your answer. Forgive my limited knowledge, but I am struggling to understand how I would develop one of the methods above into a practical solution, especially one that would be easy to understand for users trying to register. Do you think there are there products out there which deliver this kind of solution? I am sure I am not the only person on the internet trying to properly identify people who cannot turn up physically to my office. $\endgroup$ – Totoro53 Mar 29 '17 at 10:02
  • $\begingroup$ @Totoro53 all common browser support TLS client authentication using certificates and all common email clients (Outlook, Thunderbird) support S/MIME. Now it is a matter of what the user's certificate can be used for and in which applications they are installed and configured. Common webservers also support TLS client authentication so it would boil down to providing the user a link to a webpage running on eg Apache2 and then the browser will do the rest and you only have to check the environment variable. I'm not aware of any ready-to-use products but then I haven't actively looked either. $\endgroup$ – SEJPM Mar 31 '17 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.