I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would like some feedback to correct any errors in my understanding of how this stuff works. My plan is to generate a self-signed root CA certificate using makecert
with the -cy authority
option, then use makecert
to create 2 server (-eku 1.3.6.1.5.5.7.3.1
) certificates and 2 client (-eku 1.3.6.1.5.5.7.3.2
) certificates using the -iv
, -ic
, and -sky exchange
options to sign the client and server licenses using the root CA certificate, use pvk2pfx
to create a .pfx
file for each of the client and server licenses. Then, I would install the .cer file for the root CA on both of the servers and place it in Trusted Root Certification Authorities
's Certificates
folder in the Local Machine
store. Then I would install the .pfx
files for 1 server and 1 client certificate on one of the servers in Personal
certificates for the Current User
store of the account used by the application and do likewise with the remaining server and client certificates on the other server. Afterward, I would either secure in offline storage or destroy the .pvk
files.
I'm expecting that once this is done, regardless of which host initiates communication, the host acting in the server role will be able to authenticate the client and the client knows it is communicating with the real server (not a man-in-the-middle).
Is this a correct, logical, secure plan for configuring encryption between the two servers? If not, what am I missing?