3

I have deployment that includes a public asp.net website and an internal webAPI both installed on the same machine.

The webAPI will only communicate with the website. For example, it will not be exposed to the Internet, but is internal and will not be accessed by other machines.

I think to pass a pen. test, the communication between the website and webAPI may have to be HTTPS (I believe this has been raised in previous tests). In this scenario, is it ok use a self-signed cert, for example the one I create?

Improve this question
1
  • The self signed cert protects the client (identifies server), you may need mutual authentication, so a client cert, as well. Also, see if you can use the loop back address (127.0.0.1) for listening and connecting as this stays entirely within the machine in modern systems. That is, external machines won't even see the open port. Check out Windows local named ports, I've never used them but I think they're similar to UNIX named pipes. These keep communications local to the machine. Authentication still required.
    – Andrew Philips
    Nov 28, 2015 at 18:25

1 Answer 1

Reset to default
1

Yes, but only if the other side can reliable detect if that certificate/pubkey is actually in use or if it has been replaced by a different one. (And if the private key is kept safe.)

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .