0
$\begingroup$

In our project we have grpc server and clients which should satisfy mutual tls. So, there is CA and clients generate csr to sent to CA to signing it. Now I need to send csr manually to CA to sign it and also manually back to clients. If there are many clients, it becomes inconvenient.

Of course, I can add an additional server that will receive requests and send back, but I think that this is a complication and I am trying to find a generally accepted scheme.

I am new in this theme. How to organize it correctly? Or use a simple ready-made solution.

$\endgroup$

2 Answers 2

1
$\begingroup$

The ACME protocol was designed by the Internet Security Research Group, and is used by Let's Encrypt to sign domain-validation TLS certificates. Since the transport of GRPC is HTTP/2, which uses TLS for encryption and authentication (when enabled) that should be what you want.

$\endgroup$
0
$\begingroup$

You may use Browser Extension to generate CSR directly form web application, using JavaScript API provided by Browser Extension, in Browser. The key pair would be generated in User's Certificate Store or Smartcard or USB Token and post the resulting CSR to CA Server for signing which in turn returns User's Certificate (and trust chain) to users browser, which may be downloaded (imported) to Certificate Store, or Smartcard or USB Token.

Please refer to this Stacks Overflow Answer for flow diagram and JavaScript provided by Signer.Digital Browser Extension.

Signer.Digital Generate CSR and Download Certificate Flow and DEMO

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.