Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm hosting a service over HTTPS which I'd like to make fairly secure. I've heard that it's possible to create server keys which require specific client keys installed on a enduser's keyring. Is this possible, and how is it done using OpenSSL?

share|improve this question

closed as not constructive by John Gardeniers, Scott Pack, HopelessN00b, Tom O'Connor, mdpc Oct 30 '12 at 16:27

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

The keys do not require other keys. You make keys the standard way.

What you have to do is setup your web server software to require a certificate key be sent when the client makes the request. You also must configure the server to point at a database of permitted keys, or permitted certificate authorities that you trust to issue certificates.

The exact details depend on the what server software you are using.

share|improve this answer

This is actually a web server configuration, rather than anything specific to SSL.

Here's the Apache HOWTO on requiring client certificates:

How can I force clients to authenticate using certificates?

So, you would create your own Certificate Authority, and then sign client certificates using that authority. Apache will then be configured to accept those certificates. OpenSSL has some documentation here. You should be able to find other references online, perhaps with more detail if that's required.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.