5

I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would like some feedback to correct any errors in my understanding of how this stuff works. My plan is to generate a self-signed root CA certificate using makecert with the -cy authority option, then use makecert to create 2 server (-eku 1.3.6.1.5.5.7.3.1) certificates and 2 client (-eku 1.3.6.1.5.5.7.3.2) certificates using the -iv, -ic, and -sky exchange options to sign the client and server licenses using the root CA certificate, use pvk2pfx to create a .pfx file for each of the client and server licenses. Then, I would install the .cer file for the root CA on both of the servers and place it in Trusted Root Certification Authorities's Certificates folder in the Local Machine store. Then I would install the .pfx files for 1 server and 1 client certificate on one of the servers in Personal certificates for the Current User store of the account used by the application and do likewise with the remaining server and client certificates on the other server. Afterward, I would either secure in offline storage or destroy the .pvk files.

I'm expecting that once this is done, regardless of which host initiates communication, the host acting in the server role will be able to authenticate the client and the client knows it is communicating with the real server (not a man-in-the-middle).

Is this a correct, logical, secure plan for configuring encryption between the two servers? If not, what am I missing?

Improve this question
1
  • 3
    You don't need 2 certificates per server, as you can make a certificate to work as server and as client certificate at the same time. Most certificates that you buy have this option already, check the extended key usage on a certificate for any site you visit.
    – BadSkillz
    Jan 5, 2016 at 9:41

1 Answer 1

Reset to default
1

You can simply create a unique certificate signed by a purpose specific CA and force both machines to only accept certificates from that CA. It would be the Apache equivalent of

SSLCACertificateFile /your/CA/folder/ca.crt
SSLVerifyClient require
SSLVerifyDepth 1

This approach is scalable, as you can include a third machine in the future in your "security ring" to contact any of the existing machines. Only those with a signed certificate from your CA will be accepted into your ring.

Improve this answer
2
  • What would be the reasoning behind using a recognized 3rd party CA over just self-signing? CAs exist because of the need for a set of trusted 3rd parties. But the OP's organization already trusts itself, so why buy a CA signed cert?
    – Steve Sether
    Feb 25, 2016 at 19:46
  • 1
    @SteveSether He just says CA, that doesn't mean third party. You can host your own CA.
    – Robert Mennell
    Apr 25, 2016 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .