0

I cannot get an answer from a CA company for this question.

I have to implement two ways SSL authentication between my server and my users computers. Users should access to my several API securly. I have an Comodo trial certificate and I use it on my web-server.

I'm wondering can I use this certificate on two-ways SSL authentication?

Some considerations:
I thought if I put a button on a web form and if a user can download the current web page's certificate when he presses the button. This would be nice. However I cannot know when the certificate will be out of service by CA.

Ps: Actually I've been continuing to my implementation

Improve this question

1 Answer 1

Reset to default
2

No, you cannot use the same certificate for both server- and client-side SSL authentication.

(Well, technically, you can - it won't break anything - but it means that the server private key will be known to N clients, each of which can then impersonate it, so that's just not going to work out.)

If you wanted to do Client SSL authentication, you'd want to issue individual certificates to all your clients. You can do that with your own CA, they don't need to be signed by a public CA, as long as your server can verify them against that CA.

See also this answer which might be useful to you.

Improve this answer
1
  • Would it be ok to use your server cert to sign the client cert though? (EG as the issuer?)
    – NSjonas
    Dec 15, 2018 at 0:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .