We're building a webservice for a third party customer who wants us to use "two-way SSL". By which I understand them to mean they want us to host the site using https, and to require that include a Client Certificate in each http request.

I've been working through a number of examples on how to make all this work with the tooling we use, and I think I'm beginning to get a handle on it.

If I'm understanding correctly, we'll provide them with a certificate. They have their client include it in their requests, and we validate that the certificate we receive is what we expect.

What's not clear to me is whether it's usual for us to have the certificate created by a CA, or for us to do it ourselves. With SSL certificates, an unsigned cert is meaningless. But with client certs, we're expecting to receive a specific cert, so I'm not sure I see that validating that everything is signed back to a recognized root authority really matters.

Do people generally use CA-signed client certs, regardless?

  • 2
    With client certs the server specifies which CAs on the client certs they will accept (during the handshake). Thus it is totally valid to setup a CA on your system and sign every certificate yourself witht that CA and only accept certificates signed by that CA, or you can cooperate with / use a public CA if you're not confident in your processes and / or every user already has trusted certificates anyways (eg if the users are employees who all have S/MIME certificates). – SEJPM Oct 10 at 20:46

In a typical business to business setting it may be that the client is also a server for other use cases. In that case the server cert and corresponding private key of the other party could be reused. To be able to verify that it is correct you should probably pin (trust just that) certificate as you may not want to trust other certificates issued with a generic CA to connect - although you could also whitelist the particular server name.

Yes, it is perfectly valid to issue your own certs in this setting. For security reasons it is best if the other party creates a key pair with corresponding certificate request, which you then use to create a signed certificate that you can trust. For this you need a CA & CA software (and trust your own CA certificate). You could also simply trust a self signed certificate from the other party.

I think it generally just makes sense to use a normally issued certificate by a third party CA iff:

  1. either you want to reuse the cert / key material and/or
  2. you have some reason to only trust a cert with a particular host name.

Key management is a complicated matter. To avoid awkward conversations I would definitely ensure that you create the protocol together with the other party. Time for coffee and cookies!

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.