1

I want to create a client & server package with the option of an encrypted connection.

From my limited understanding, to get HTTPS connections working, the user needs their own certificate installed on their machine and this means that the client software needs to allow all certificates (with a user-specified public key/thumbprint?).

I'm new to the concept of certificates so I don't know about any of the associated dangers here. Could you please briefly list some problems with this approach?

Improve this question
3
  • Possibly a duplicate of Self signed certificates for https? The second answer there addresses most of your concerns, unless I am misreading your question.
    – apsillers
    Jun 14, 2013 at 16:51
  • When you say, "the user needs their own certificate," do you mean "the user" of your server software or client software? Client participants in HTTPS generally do not provide their own certificates, since they do not need to cryptographically prove their identities to the server. Are you in fact asking about client-based auth in HTTPS because you have a need for client verification in your software package?
    – apsillers
    Jun 14, 2013 at 16:53
  • I mean that the user of the server software needs to make their own self-signed certificate to provide HTTPS connections between server and client. The client software would validate the thumbprint or public key of the certificate with user-specified values to ensure the right one is being sent. Is this correct and are there any dangers with this?
    – user1092719
    Jun 14, 2013 at 21:57

1 Answer 1

Reset to default
1

To enable your clients to securely communicate with your server, you will need an SSL certificate for your server that is either self-generated or signed by known certificate authority. If you go with self-signed you will need to provide the public key of that certificate along with your software.

If you want to identify your clients, they will each need a unique client certificate probably signed by your CA.

Short version:

  • Secure client/server communication - server certificate

  • Secure client/server communication with authenticated clients - server and client certificates

It sounds to me like you should pull in an expert for this part of your project. Crypto is easy to get wrong and important to get right.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .