8

I know people buy SSL certificates to secure their sites. What kind of certificate should I get if I want to encrypt a connection between an application server and a database? Application server may not be accessible through a public url, by the way.
My question is general, but the real situation is Windows environment on both servers and RavenDb as a database, if that matters

Note: I control both servers and their security settings.

Improve this question
3
  • 1
    If the TLS-server (i.e. the database) is on a domainname which is not a public domain you control or a subdomain of the same, you can't get a "real" CA-issued cert because you can't prove control of the name(s) in the cert, so your only choice is self-signed, as answered already.
    – dave_thompson_085
    Jan 23, 2016 at 2:03
  • @dave_thompson_085 Is this true? I think that you can also sign the certificate with your own internal trusted CA that is not the same as self-signed, am I wrong?
    – Eloy Roldán Paredes
    Jan 25, 2016 at 18:18
  • @EloyRoldánParedes you're right; I should have distinguished here a "widely-trusted" CA (like Symantec or Comodo) which will only give you a cert for a public domain(s) (or address(es)) versus an internal CA which can give you a cert for whatever name(s)/address(es) you want. Thanks.
    – dave_thompson_085
    Jan 26, 2016 at 3:13

3 Answers 3

Reset to default
4

It is important to understand that certificates provide integrity and encryption provides confidentiality. In other words; the certificate makes sure that you are talking to who you think you are (if part of chain of trust), but it does not encrypt your connection. However integrity and confidentiality nearly always go hand-in-hand, which is why the public key of a client is contained within its certificate. Once the identity of the asset serving the certificate is verified, its public key can be used to encrypt the connection and negotiate further encryption details.

In theory it would suffice to simply generate a keypair on both the database server and application server, and use those to configure the encryption between the two. The fact is that many systems require certificates to encrypt the connection, so as said, also the identity of the other side of the connection can be verified. Since your application is not publicly facing, the certificate does not need to be signed by a CA. You would just need to generate a keypair, create a CSR out of it, and consequently self-sign it. No money has to be spent here.

You can use these self-signed certificates to configure the encryption between the database and your application.

Improve this answer
1
  • Small correction: You (always?) need a CSR to get a "real" CA-issued cert but not always for selfsigned. E.g.: openssl can do selfsigned cert directly (still using req but with -new -x509 there is not actually any CSR); Windows makecert and NSS certutil and Java keytool -genkeypair do key AND selfsigned cert directly,.
    – dave_thompson_085
    Jan 23, 2016 at 1:59
2

encrypt a connection between an application server and a database

I think you should just establish an IPSEC tunnel between the database server and app server. This will provide you both confidentiality and integrity. (ESP + AH)

Configuration Reference

Improve this answer
1
  • +1, although a justification would have been good - IPSEC has much lower latency and slightly better throughput than SSL/TLS (depending on how it is configured).
    – symcbean
    Jan 13, 2016 at 23:40
0

If you control both servers, you don´t even would really need to use certificates, just setup on each side the trusted public key for the other side and use that to stablish a SSL/TLS like connection.

However, probably the easiest way of doing this is really using SSL/TLS and certificates, just because this is the only way you will be able to setup such a protected connection on most systems. But you do not need to buy a certificate on this case, it is okay to use self-signed certs, since you will not have too much real advantage on using a trusted CA to issue the certs. The matter here is just how good you protect the database side private key. If you have a self signed certificate or a CA signed certificate for that key, but you loose the private key, the effect is almost the same since the quickest way to mitigate it is removing the key trustworthiness on the application and replacing it for a new one (on a CA you could also ask for certificate revocation, but that would take more time to be effective).

What you need is to generate a self-signed cert for the database, and setup the database to use it. Then put this certificate as trusted on the application connection configuration.

Maybe you can do even better, if your database supports client certificate verification, you could have also a cert in the application that is trusted in the database. Therefore to connect and stablish a trusted connection one would need to have both client and server private keys. But Im not aware if any database supports it. If you provide details on the database you use, one might give more detailed answer.

Improve this answer
5
  • personally I would create a VPN link between them both separate networks or not allowing a max of one connection and then do what you suggest XD (#paranoid) using a .crt
    – TheHidden
    Jan 13, 2016 at 13:01
  • @silverpenguin yes, good too if you control not only both application and database, but also de operating systems/network.
    – CristianTM
    Jan 13, 2016 at 13:08
  • vpn is dangerous over wan, beacouse data packets can be thrown into the wan after vpn connection failure
    – integratorIT
    Jan 13, 2016 at 14:05
  • How do you have "trusted public keys" for network transport without certificates?
    – symcbean
    Jan 13, 2016 at 23:42
  • @symcbean by trusting directly the key. As you do on SSH as an example.
    – CristianTM
    Jan 13, 2016 at 23:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .