0
$\begingroup$

I currently am being asked to partake in a strange authentication format while working with a client, and was hoping for clarification.

The client is using HTTPS with client certificate authentication, therefore I will install their provided certificate within my browser as a form of authentication.

As a second step, they are also asking that I create my own certificate and have a CA sign it, and then provide them with the certificate and CA so that the server is configured to authenticate with the client.

While I can create a certificate with openssl from the command line, have it signed, and send it to them, how is this authenticating/verifying my browser at this point?

| improve this question | |
$\endgroup$
  • $\begingroup$ From your description it is not clear if they sign your cert with their CA responsible for signing or if they will accept your certificate hard coded. Either one is possible (but not both). $\endgroup$ – eckes May 10 '17 at 20:17
0
$\begingroup$

So here's the work flow again:

  • You generate a key pair and secure the private key.
  • Your formulate what is called a certificate signing request (CSR).
  • You send it to their CA.
  • You get back a certificate signed by their CA and install it (along with the private key) such that your browser can use it.

Also note that while you could replace the CSR in this step with a self-signed certificate, it's certainly a non-standard way of handling things, but should work. In the end you would use their certificate anyways, because it has the signature by the trusted CA.

Now during the TLS handshake, the server has the option to request a client certificate. The server can also explicitely provide accepted CAs here. This will trigger a dialog in your browser asking you to select a certificate to be used for authentication.
Then your browser signs the transcript of the TLS handshake thus far using the private key associated with the selected certificate and sends the certificate and the signature to the server. This proves posession of the private key and thus of the fact that you are the rightful owner of the certificate, which confirms your identity to the server.

If this is "too high-level" for you, you can also look at more details on Wikipedia or view the full picture in RFC5246.

I am being asked to send it to a CA of my choice for signing, and then to send the client my public key for their configuration.

In this case they probably will use one of the standard lists of trusted CAs. You then get a certificate from said CA. They probably ask you for the public key for app-level identification, ie the TLS engine will provide the app with your client certificate and then map your actual identity based on the embedded public key. What I somewhat fail to see here is why they can't just let you have any certificate containing the right public key (even a self-signed one) if they will authenticate you via said public key anyways.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thank you for the response, it is definitely insightful. In this case, I am being asked to send it to a CA of my choice for signing, and then to send the client my public key for their configuration. Does that seem about right to you? $\endgroup$ – acelives May 10 '17 at 15:35
  • $\begingroup$ An additional question as well - when generating the CSR, what Common Name would I use? This is not coming from a specific domain that I own (such as to verify my server), but instead would be a cert that I install in my browser. Does the CN matter at this point? $\endgroup$ – acelives May 10 '17 at 15:45
  • $\begingroup$ @acelives the CN should contain what your CA asks you to let it contain. Some will straight-up ignore the provided data and rather use account-bound data, but this is really something you have to ask your CA / look up in their public documentation. In theory the CN is supposed to hold identifying information, eg a primary email, a natural name, potentially physical adress or something else. It appears though that the CN doesn't matter much in your case. $\endgroup$ – SEJPM♦ May 10 '17 at 19:33
0
$\begingroup$

You have to use the certificate (which will have your public key) which you had generated, to configure your browser. This certificate can be used by your browser to authenticate itself with server.

| improve this answer | |
$\endgroup$
  • $\begingroup$ So, my browser will contain both the certificate I generated (to validate itself) and the certificate they generated (for authentication)? $\endgroup$ – acelives May 9 '17 at 16:11
  • $\begingroup$ Use only the certificate you had generated and got signed by a ca. $\endgroup$ – Uraguan May 10 '17 at 5:55
  • $\begingroup$ An additional question as well - when generating the CSR, what Common Name would I use? This is not coming from a specific domain that I own (such as to verify my server), but instead would be a cert that I install in my browser. Does the CN matter at this point? When looking to have the cert signed by a CA, they are going to validate that I 'own' the domain (or CN), won't they? $\endgroup$ – acelives May 10 '17 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.