Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Can i authenticate myself in SSL with a key, just like in SSH?

share|improve this question
-1 this is poorly written. – Rook Mar 5 at 23:17
3  
Learn reading then. Or explain what exactly is poor. – Smit Johnth Mar 6 at 1:10
Smit - despite the terseness of rook's comment, he has a good point. When you say 'just like in SSH' there are a number of things you could mean. It would help everyone if you list the authentication functionality that SSH gives you and you want from SSL. – Rory Alsop♦ Mar 7 at 7:30
I just don't want to enter password. This is all information i could give you. KK? – Smit Johnth Mar 7 at 13:39

1 Answer

up vote 5 down vote accepted

SSL/TLS supports authentication of the client with an asymmetric key pair. Since this is SSL, it takes the form of a client certificate. The server requests a certificate during the initial handshake, indicating which root CA the server will use to validate that certificate; the client then sends a certificate to the server. This of course requires the client to actually have a certificate to send.

Usual clients (browsers) and servers support this feature. What the server does with the certificate is entirely up to it. In a Microsoft Active Directory + IIS world, the client certificate, once validated, is mapped to an account through one of several mechanisms (either the certificate itself is already attached to the account in the AD server, or the account name is found as a "User Principal Name" in the client certificate).

@Rook talks about TLS with SRP, which is something completely different: with SRP, client and certificate authenticate each other with a shared secret (a password). There is no certificate anymore, not in the client and neither in the server. This has no equivalent in SSH (there was a patch to SSH for that, but it is not much maintained; it does not map well to account names and authentication as they are usually managed in operating systems). Usual SSL clients and server do not support SRP (but this may come in the future).

share|improve this answer
Is it possible to make them self signed? – Smit Johnth Mar 5 at 21:43
As far as SSL is concerned, the certificates can be self-signed. It is up to the server to decide which certificate is acceptable or not. Self-signed client certificates closely emulate SSH key-based authentication. – Thomas Pornin Mar 5 at 22:25
@SmitJohnth, you can indeed use self-signed client certs (although I'd still verify the server cert the traditional PKI way), but this may require a bit of tweaking, since most frameworks expect a PKI model. In most cases, you may have to implement your own trust evaluation with the SSL/TLS stack, or disable it and do it within your application. Make sure your customisations eventually perform some form of verification (e.g. against a fixed list of public keys) before considering the client to be authenticated, from the application's point of view. – Bruno Mar 15 at 19:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.