1

We have a website which is accessible on the internet. But we only want our partners to access our website, so we generate a self-signed server certificate and certificates signed by our self-generated certificate for our partners. When accessing our websites, partner needs to provide the certificate.

That is, our website uses client certificate verification. Anyone without a certificate issued by us shouldn't, in theory, be able to access our website, not even seeing the login page or something else. This is used as the first line of security measure. (others are another story though)

Is this enough to prevent unwanted access to our website?

  • If you want to add further security (and make it more annoying to log in) you could add multi factor authentication as well – Nick.McDermaid Jul 5 '18 at 7:09
2

I would like to detail this post about client certificates based on the blog What Is Client Certificate Authentication?.

  1. we have a website which is accessible on the internet. but we only want our partners to access our website, so we generate a self-signed server certificate and certificates signed by our self-generated certificate for our partners. when accessing our websites, partner needs to provide the certificate.

This would prevent the unauthorised access, if you've properly configured your web-server to ask for the client certificate from the client's accessing-application (browser, etc).

As a feedback, I'd like you to visit the link: What are the risks of self signing a certificate for SSL. If it is possible for you to obtain the server-certificate from a root CA, that'd be advisable. But, that's your call.

Quoting from the blog listed above:

If a server's enabled with client certificate authentication, only users who attempt to connect from clients loaded with the right client certificates will succeed. Even if a legitimate user attempts to connect with the right username and password, if that user isn't on a client application loaded with the right client certificate, that user will not be granted access. In fact, if that user's connecting from a Web browser, the login page (where he's supposed to enter his username and password) might not even load at all like the one shown below.

enter image description here Additionally, I'd recommend you to incorporate more factors of authentication so that there is least chance of security breach. You've not mentioned the details about your website.

  1. Is this enough to prevent unwanted access to our website?

Yes, it should prevent unwanted access. But, you already know there is no silver bullet in security.

You should not only think in terms of your web-application here, but also from the infrastructure which you're managing. There are several other threats like DoS, etc. which needs to be taken care of. Anyway, that is altogether a different story and people have written books over the topic.

I hope this helps. Thanks to you for asking this question.

  • Is it possible to access my website even without client certificates using some kind of customized tools ? – user476656 Jul 5 '18 at 6:13
  • 1
    @user476656 - If you configured your server to ask for client certificate as authentication, then you won't be able to access your website(unless there is some sort of breach which I'm not aware of). I'd also refer you to go through Advantages of client certificates for client authentication?, and know that there are quite advantages compared to traditional forms of authentication. – Am_I_Helpful Jul 5 '18 at 6:20
  • May I know why the downvote? – Am_I_Helpful Aug 26 '18 at 17:45
1

Yes it's secure if the client certificate is stored in a secure location. You can add a authentication scheme on the website after the client certificate authentification too.

To give an example, some sensitive medical's website use the same tip to secure their website, but they give each users the certificate in a more secure's way, on a smartcard (like a gemalto) protected by a pin.

As you can see the security of such authentication method is tied to the location the remote peers secure the certificate.

  • 2
    OP is talking about client certificates. Different story. – Esa Jokinen Jul 5 '18 at 4:58
  • @EsaJokinen Thanks for the input, edited to reflect the question, badly read it yesterday..(the op edited his question to make it clearer too after my answer) – yagmoth555 Jul 5 '18 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.