Is this way of client-side SSL secure enough, to keep hackers away from my web app?

Question

I'm wonderying if the following steps are enough to protect my cloud service, in a meaning that non-authorized users can not play with my web app?

In other words, is it possible to bypass this kind of protection?

So the steps are:

Create a Certificate Authority root (which represents this server)

Organization & Common Name: Some human identifier for this server CA.

openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key -out ca.crt

Create the Client Key and CSR

Organization & Common Name = Person name

openssl genrsa -des3 -out client.key 4096
openssl req -new -key client.key -out client.csr
# self-signed
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt

Convert Client Key to PKCS

So that it may be installed in most browsers.

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12

Convert Client Key to (combined) PEM

Combines client.crt and client.key into a single PEM file for programs using openssl.

openssl pkcs12 -in client.p12 -out client.pem -clcerts

Install Client Key on client device (OS or browser)

Use client.p12. Actual instructions vary. Install CA cert on nginx

So that the Web server knows to ask for (and validate) a user's Client Key against the internal CA certificate.

ssl_client_certificate /path/to/ca.crt;
ssl_verify_client optional; # or `on` if you require client key

https://gist.github.com/mtigas/952344#create-a-certificate-authority-root-which-represents-this-server

My virtual host look like this:

SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile "cert/ca.crt"

Any sugesstions?

Answer 1

Yes, this is enough secure.

I would suggest checking for:

perl: $ENV{'SSL_CLIENT_M_SERIAL'}

in your web app. This means you will have to have a database of valid users, and possibly which rights they have in the web application.

Doing this instead of doing revocations the "PKI way" is better, since then you first, does not need to manage a CRL, and also, its easier to put in what users are really allowed to do, so you can have users who have different rights, for example some users might be admins, some might be moderators, and some just regular users, and some are limited users.

So first, their certificate must be signed by the client CA, but also, their certificate serial needs to be in database as valid. Make sure and be careful so you don't generate multiple user certificates with the same serial. The serial can also then be used as a numeric UserID in modules that require a numeric UserID.