1

I've read a lot of articles about client certificates. Please correct me if I'm wrong:

  1. client certificates are issued using CA
  2. CA could be created by myself (self-signed) or bought
  3. client certificate has pair of public\private key and signature created using private key of CA
  4. client needs to have installed client certificate only
  5. server needs to have installed CA to validate signature of client certificate using public key CA

Question: what is difference between bought CA and self-signed CA? Because as I understand in both cases I need to install CA on server to validate client certificates.

3

Let me address your root question (pun intended):

Question: what is difference between bought CA and self-signed CA? Because as I understand in both cases I need to install CA on server to validate client certificates.

Background

To answer this, let's make sure we understand what a certificate is. When you have a public key / private key pair you can give the public key to whom ever you want, it's public, but how will people know that it's actually your public key? Imagine this scenario: Alice sends her public key to Bob, but Charlie intercepts the message and replaces Alice's public key with his own. Bob has no way of knowing that the public keys were switched because all he sees is a public key. Now Bob thinks he has a secure connection with Alice, when in fact he has a secure connection with Charlie who's pretending to be Alice.

Certificates solve this problem of knowing whose public key you have. The process is that I will contact a Certificate Authority company and prove to them that I am who I say I am (exactly how they want you to prove this is answered in this question). Then I can submit my public key to them and they will bundle it into a certificate, which contains the public key itself and a bunch of information about who I am. The CA will sign the certificate to say "We certify that this public key belongs to this person", and so that the data in the cert can not be modified. Now I have an "official" document proving that this public key belongs to me. Now there's no way for Charlie to pretend to be Alice.

In most cases, you will not be requesting a certificate for yourself as a person, but for a specific server within your company, or in your case clients, but the idea is the same.

Answer

You have 2 ways of getting your public key made into a certificate:

  1. You can submit it to one of the publicly trusted root CAs of the internet (Digicert, Verisign, godaddy, letsencrypt, etc) who will issue you a certificate (for a cost),

  2. Or you can make your own self-signed CA and issue yourself a certificate.

The only real difference between the two comes down to public trust; if you pay one of the public roots to certify your public key then every computer on the internet will automatically trust your certificate to be genuine and authentic because they trust the CA's reputation. Zero extra work for you.

If you make your own self-signed CA then every computer will say "what is this, and why should I trust it??" (remember that Charlie can easily make his own CA and create a certificate with Alice's name attached to Charlie's public key). So you will have to manually go onto every computer that needs to validate one of these certs and tell it to trust your self-signed CA by adding the self-signed root certificate to that computer's "Trusted Root Certification Authorities Store".

Advice

Making your own self-signed root CA is not necessarily bad, it depends on what you're trying to do. In a lot of cases, having your certificates be publicly trusted on the whole internet does not add anything. For example, in a corporate ID badge system to get into the building; who cares whether those ID badges are publicly trusted or not - you only care about whether the door scanner recognizes them. Or client certs on embedded devices; the devices will need to authenticate to a server to receive firmware updates - only that server will ever need to validate the certs.

If your use-case is one of these "closed system" use-cases, then by all means, use your own self-signed CA.

  • "If you make your own self-signed CA then every computer will say "what is this, and why should I trust it??"" - For https I use "bought" certificate from widely trusted 3rd party. I want to use self-signed root for creation of client certificates. And in this case I need to install it on server only. Or not? – mtkachenko Dec 11 '15 at 15:26
  • That depends, client certificates for what? S/MIME email? SSH? Physical access cards? Code signing? Firmware updates? Where you need to install the root depends on what you're doing with the client certs. – Mike Ounsworth Dec 11 '15 at 15:30
  • I'm going to use client certificates for authentication in web api. I will send client certificate to consumer of my web api. – mtkachenko Dec 11 '15 at 15:32
  • Then yes, that's one of the "closed-system" use-cases. You are correct that only the server(s) accepting these requests and authenticating the clients need to know about your root CA. Sometimes people actually make a separate authentication server for web APIs to make maintenance of the system easier. – Mike Ounsworth Dec 11 '15 at 15:35
  • 1
    S/MIME: if you want to send signed email to people outside your organization, they will have to install your company's mail server's root cert first ; Physical access cards: you'll need to propagate the root cert to all the embedded scanners ; code signing, anyone who installs your software will need your root cert ; web API calls between your servers and another company's servers (ex Amazon), the other company will need to install your root cert on their servers. The list goes on and on. – Mike Ounsworth Dec 11 '15 at 15:44
1

CA stands for certification Authority and it is different from a Certificate. your Clients will present Certificates and not CAs.

your Server should be able to verify the client certificate regardless of if you use Self-Signed client Certificate or if you use 'bought' client Certificate. To do that verification, your server should contain the Root certificate of the CA.

If you use Self Signed Certificates for your clients, then you have to create the Root Certificate and install it in the Server.

If you buy Certificates for Clients, then the corresponding Root Certificates for these clients may already be available in the Key Store of your Server - you have to install them otherwise.

There is also https://letsencrypt.org/ which provides "bought" certificates for free.

  • So if I create root CA (which will be used to create client certificates) I need to add it to "Trusted Root Certification Authorities Store" on server. Is it correct? – mtkachenko Dec 11 '15 at 11:58
  • yes, thats right – JOW Dec 11 '15 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.