6
$\begingroup$

I'm working on software where multiple components will communicate with each other using SSL.

There would be one central component acting as a server, which would also require the clients to present a certificate. So there is mutual trust between the clients and server. The software will be deployed internally within organisations.

To avoid the pain of creating and distributing multiple SSL certificates, can a single certificate be generated once for each organisation, and then used by all of the components within that organisation?

|improve this question
$\endgroup$
4
$\begingroup$

If all the components share the same certificate, then they share the same private key. This raises the two following points:

  • When a secret is shared by more than two people, can it still be considered really secret ? Secrecy dilutes fairly fast. If all components share the same secret value, then breakage of any single component reveals the private keys and endangers the whole system. Similarly, every single client or server has the power to impersonate every other client or server in the system.

  • If client and server share the same secret value, why would you use certificates at all ? Certificates make sense when every entity has its one private key which never travels around. If client and server contain the same secret sequence of bits, then they could use pre-shared key cipher suites, which will use no certificate at all, and might be faster as well.

|improve this answer
$\endgroup$
  • 1
    $\begingroup$ The secret isn't really being shared by more than 2 people though - it's being shared by multiple components of the same system. Sort of like a pre-shared key, but with public-key capabilities. Good point about a single machine being compromised potentially endangering the whole system though. $\endgroup$ – Owen Orwell Mar 31 '13 at 14:01
  • $\begingroup$ On your second point, we'd use certificates for two reasons: firstly, we will use SSL/TLS for communications because it's fairly ubiquitous, and supported by some of the 3rd party components we will use. Secondly, because one of the components will digitally sign files, and we need to verify those signatures later $\endgroup$ – Owen Orwell Mar 31 '13 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.