2

Given a SSL-protected site that was formerly whitelisted (Allow from x.x.x.x etc), and and a requirement from a customer to change the way authentication works, to use X.509 HTTPS Client verification.

The problem with this is that none of "the usual suspects" of SSL CAs have the ability to generate X.509 certificates without buying into the CA's Managed PKI service.

I've only ever done this for internal clients only, so it's easy enough to generate a self-signed CA, and drop the CA's public certificate into the clients' keychains. For external customers, it's a bit less easy to do, and to convince them to do it.

So it seems that the options are : Go down the route of a managed PKI service. - Apparently this is prohibitively expensive and would mean replacing the internal CA stuff too?

OR

Get a CA to sign their root certificate.

Is that right? Has anyone done something similar before? Does anyone know a ballpark estimate for what a Trusted Root might cost?

This is not a shopping question.

Improve this question
7
  • Why not just use a CA's regular client signing service? Why do you need these certificates to be trusted by anyone but you?
    – David Schwartz
    Mar 26, 2013 at 12:00
  • Wasn't able to find one that didn't require their full PKI solution.
    – Tom O'Connor
    Mar 26, 2013 at 12:01
  • Here one. But you don't need your certificates to be trusted by anyone but you anyway, so you don't need a CA to sign anything.
    – David Schwartz
    Mar 26, 2013 at 12:07
  • Doesn't the customer still need to trust the CA that generated the client certificate?
    – Tom O'Connor
    Mar 26, 2013 at 12:14
  • Trust it to do or prove what? The server is trusting the client certificate to identify the client. The client isn't trusting it to do anything.
    – David Schwartz
    Mar 26, 2013 at 12:15

1 Answer 1

Reset to default
0

If the customer is willing to install client certificates in their users' web browsers to access your site anyway, then using a self-signed CA really isn't that much of an issue, since you can just throw in that certificate as well while you're at it.

Improve this answer
1
  • Except then the security of your CA is the security of your client's banking.
    – David Schwartz
    Mar 26, 2013 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .