0

I have a site that is protected with a user name/password login. For users that want to enter a certain area of the site, there is (legacy) code that looks for a client certificate and if the email in the cert matches the email associated with the login, then they can access this (extra) protected section.

Some questions about that approach:

  1. Can we continue to accept certs as long as they are from a trusted
  2. What prevents malware from stealing the client cert from a user's machine and placing it on another, compromised machine and using it from there?
  3. The way it stands now, as long as the cert comes from a system standard or commonly accepted CA, it is accepted. Should we change the logic to issuing the client certs ourselves, adding our own CA to the list of trusted CAs and only accepting certs signed by our CA? We don't really want to do this though as it does not scale to support the amount of users.
  4. Would it be better to give a signing cert to the users' parent company, and allow them to issue client certs. We then would only trust certs from the signing cert (or from our own CA, which would be in the trust tree).

I am asking a lot here, I know. If need be, I can refine the question with some guidance.

Improve this question
0

2 Answers 2

Reset to default
3

Using client certificates that are not issued by you poses some threat.

Anyone who knows the email of one of your users and can find a CA in your trust list that is not very strict about user verification, can get themselves a forged certificate with this email. Then they can access the private section.

Managing your own PKI is complicated, but can solve this issue.

Giving a signing certificate is turning the burden to the client's company, which might or might not be a good idea depending on their expertise and trust-ability to operate the PKI seriously.

At the end, the answer is always "it depends". You have to compromise between the risks and costs of dealing with the risks.

Improve this answer
1

1) It depends. How is the CA validating the user? And do you trust that process?

2) Nothing. You should assume malware fully compromises that user.

3) That's up to you on whether you want that responsibility.

4) If you trust the parent company to validate users and issue certs appropriately, sure.

Improve this answer
2
  • Does #3 gain us anything? I guess it puts the responsibility on us to validate the users, and therefore if we trust that process, we can trust the cert. #2 - What good are client certs then? I must be missing something.
    – slolife
    Commented Feb 25, 2016 at 21:56
  • If you trust a process, trust the Cert. If you don't trust a process, don't trust the Cert. Client certs make brute force attacks nearly impossible, unlike passwords.
    – d1str0
    Commented Feb 25, 2016 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .