2

We are trying to set up client certificate authentication for VPN users on Cisco ASA. User certificate store is being used to complete the authentication. The problem we are running into is that the user doesn't have rights to access the private key which in turn results in certificate validation failure. But my question here is that why do we even need access to the private keys to complete the authentication process.

Improve this question
1

1 Answer 1

Reset to default
4

The public key is - like it's name suggests - public. It can thus not alone be used for authorization, since everybody knows it. But only the owner of the private key is able to sign some random challenge and this signature can then be verified by everybody having access to the public key - in this case the server which has sent this challenge to the client. Thus it is essential that the client has access to the private key. And not only the client must have access to the private key but it should also the only one who has access (therefore: "private" key), because everybody who knows the private key can claim the clients identity.

For more information see the basics of Public Key Cryptopgraphy.

Improve this answer
1
  • Thank you for clearing this was confused regarding the digital signature on the certificate. I thought that signature on the certificate will be from CA issuing the certificate wasnt sure of client generating its own signature. Thats the way it should be as client here has to prove his identity.
    – Ravneet Singh
    Jul 30, 2015 at 22:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .