4

I read about server authentication over web and got to know that issuer Root CA should be imported into Trusted Root CA on both server and client machines for mutual authentication.

Now let's say it is banking application and user connects to the bank server for the first time:

  1. Server returns server certificate to validate itself to client.
  2. Client gets the certificate and validate with trusted Root CA authority which has signed this server certificate earlier.
  3. Client sends its certificate and server validate with trusted Root CA authority which has signed this client certificate earlier.
  4. Now communication starts.

Step 3 - I understand that trusted Root CA authority installed on the server when server gets deployed.

But in step 2, as the client machine connected first time (and the user can dynamically connect from any machine), how did Root CA authority get installed on the client machine?

Improve this question

1 Answer 1

Reset to default
6

For PKI, a set of trusted Root CA certificates is supplied with a device, an operating system, or a third-party software.

For example Microsoft, Google, Mozilla, or Apple maintain databases of trusted root certificates and provide them with their products:

Some other companies (like Lenovo or Dell) rather infamously used to add root certificates to their preinstalled OS.

In enterprise environments, additional certificates might be distributed to the workstations with the use of an administration software.

On the other hand, if by the "banking application" you mean an application installed on the client machine, then if it does not use PKI, the certificate must come bundled with the application.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .