Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Let me explain my situation.

I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, password, email address, telephone number etc before they can use the web service.

Now, in every web service method, I check the certificate sent by the vendor to determine who he is. How can I link the information in the certificate with the registration details?

For instance, I was thinking of asking the vendor for the certificate's serial number on the registration page. Then, when the web service call is made, I simply get the serial number from the certificate sent and compare it with all entries in the database. If there is a matching record, then the vendor has been located inside the database. However, I don't think that this is secure because anyone can know the serial number of a specific certificate and register with it. Moreover, what happens if the vendor's certificate was stolen and being used by someone else?

I also had an idea of comparing the URL from where the web service call originated with the host domain in the certificate. However, I recently found out that this is not possible since a web service can be called from a console application for example. What I could is compare the IP address from where the web service call originated. However, there are two problems associated with it:

1) I am working on one machine, meaning that every IP address sent by my vendors will be 127.0.0.1

2) Large online vendors such as Amazon usually have a lot of sub IP addresses and servers.

How can I solve this problem? How can I link the information found in the certificate sent with the web service request with the details that the vendor provided in the registration process to ensure that he is who he claims to be and to locate him in the database?

How is this implemented in the industry?

Thank you.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I solved the problem by having the vendor send the public certificate as well as a digital signature along with the signed text.

The server would then verify the digital signature by using the certificate's public key.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.