Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL".

Background:

  1. I am deploying an application to a private network, but I still need to use SSL for some of the authentication mechanisms. I was thinking that an SSL cert from a standard CA would not work since there is no outside access from within the network, and therefore no way to verify the cert in some way (if verification occurs at all).
  2. Service clients would be connecting a variety of ways... browsers, java, .Net, etc... I'd hate to degrade the utility of SSL by turning off features, but I'll keep that as an option.
  3. If verification does occur, I think I'll need to deploy my own certificate authority (I realize this would involve distributing a root certificate to all the clients, it's not ideal, but it should be acceptable), but I can't seem to find any information on a "verification provider".
share|improve this question

1 Answer 1

up vote 1 down vote accepted

When a SSL connection occurs, the client must make sure that it is talking to the right server. This entails validating the server's certificate with regards to a set of known trust anchors (aka "root certificates"), and also verifying the revocation status of the said certificates (the server's certificate, and every needed intermediate CA certificate between a root and the server's certificate). Revocation is the way a CA says "whoops, my bad, ignore that certificate if you see it, even if it has a seemingly correct signature on it". Revocation status is obtained by downloading a CRL from the CA, where CRL are regularly updated signed objects issued by the CA (typically once per day).

(Alternatively, revocation status can be obtained with OCSP, which does not susbtantially change the picture.)

So revocation status check normally implies some sort of connection to the issuing CA (possibly an intermittent connection or an active regular push from the CA). In some setups, you could do without revocation; this is equivalent to stating that the server's private key will never be stolen.

If the server requests a certificate from the client, the mirror scenario occurs as well.

share|improve this answer
    
So, looks like I'm correct in that I'll need a local (to the private network) CA to issue certs. –  Daniel Bower Sep 20 '12 at 3:06
    
@Daniel, you don't necessarily need a direct connection. Some applications are configured explicitly with their own copy of the CRL file (which is signed by the CA anyway). This is what Apache Httpd's SSLCARevocationFile/Path is used for, for example. You'd need to update this file one way or another regularly (before it expires). –  Bruno Sep 23 '12 at 19:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.