Self-signed certificate to protect website

Question

We have a website which is accessible on the internet. But we only want our partners to access our website, so we generate a self-signed server certificate and certificates signed by our self-generated certificate for our partners. When accessing our websites, partner needs to provide the certificate.

That is, our website uses client certificate verification. Anyone without a certificate issued by us shouldn't, in theory, be able to access our website, not even seeing the login page or something else. This is used as the first line of security measure. (others are another story though)

Is this enough to prevent unwanted access to our website?

Answer 1

I would like to detail this post about client certificates based on the blog What Is Client Certificate Authentication?.

1. we have a website which is accessible on the internet. but we only want our partners to access our website, so we generate a self-signed server certificate and certificates signed by our self-generated certificate for our partners. when accessing our websites, partner needs to provide the certificate.

This would prevent the unauthorised access, if you've properly configured your web-server to ask for the client certificate from the client's accessing-application (browser, etc).

As a feedback, I'd like you to visit the link: What are the risks of self signing a certificate for SSL. If it is possible for you to obtain the server-certificate from a root CA, that'd be advisable. But, that's your call.

Quoting from the blog listed above:

If a server's enabled with client certificate authentication, only users who attempt to connect from clients loaded with the right client certificates will succeed. Even if a legitimate user attempts to connect with the right username and password, if that user isn't on a client application loaded with the right client certificate, that user will not be granted access. In fact, if that user's connecting from a Web browser, the login page (where he's supposed to enter his username and password) might not even load at all like the one shown below.

Additionally, I'd recommend you to incorporate more factors of authentication so that there is least chance of security breach. You've not mentioned the details about your website.

2. Is this enough to prevent unwanted access to our website?

Yes, it should prevent unwanted access. But, you already know there is no silver bullet in security.

You should not only think in terms of your web-application here, but also from the infrastructure which you're managing. There are several other threats like DoS, etc. which needs to be taken care of. Anyway, that is altogether a different story and people have written books over the topic.

I hope this helps. Thanks to you for asking this question.

Answer 2

Yes it's secure if the client certificate is stored in a secure location. You can add a authentication scheme on the website after the client certificate authentification too.

To give an example, some sensitive medical's website use the same tip to secure their website, but they give each users the certificate in a more secure's way, on a smartcard (like a gemalto) protected by a pin.

As you can see the security of such authentication method is tied to the location the remote peers secure the certificate.