2

The answer to this is probably simple, but it eludes me.

Here's the scenario: At the moment, I have a server with a certificate issued to it using HTTPS that a customer POSTs responses to after processing requests sent from a web service. The customer's server has their own certificate issued to it and it also uses HTTPS. Neither certificate is a wildcard cert.

As part of the original setup, the customer requested that my server had a certificate (unsurprisingly). Now, the customer has an additional requirement as part of a recent upgrade. They want my root cert installed on their server.

As I mentioned above, my server already has a valid, non-wildcard certificate. When their server POSTs to mine, they already see that valid cert, and when my server talks to their server I see their cert. So what would my customer gain from this?

Edit: To clarify, my certificate is signed by a third party CA.

2

On this certificate of yours, it's important to know if you signed it with your own company's root certificate; or did you have a third party sign it?

If it's signed by your private root certificate, they won't have a copy so they have no way of validating the connections to you are legitimate. If you give them a copy, they will then have a way to validate your server's certificate and know they aren't being tricked.

If your certificate is signed by Thawte, Comodo, Entrust, or one of the other commercial Certificate Authorities out there, then they would have no need, as those root certificates are already public and installed in their machines already. That's the purpose they serve on the web.

It would be best practice to have any certificate you intend to share with some third party to be signed by a commercial service. That way, they wouldn't have to install your company's root certificate.

--

Normally, you wouldn't want to install some other company's self-signed root certificate as a root certificate on your box, as there is a very powerful set of trust implicit in the certificate. With that certificate, servers will believe any connections signed by it. You could forge and sign a certificate for www.google.com or www.fbi.gov, and they would trust any connections to them implicitly.

  • That's exactly what led to me to raise this question, as my certificate is signed by a third party CA, so the request struck me as odd. – badger2013 Apr 15 '16 at 21:30
2

Installing root certificates on a server causes that server to implicitly trust any future certificates signed by that root. By installing that root cert, you could then use self-generated certificates that are signed be the root that was installed.

This adds a layer of security in that your root is not distributed for use by other servers/instances, and would not need to be replaced if of those signed by it was compromised; you could simply revoke the compromised one and issue a new one signed by your root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.