Is there any security enhancement when I use self-signed client certificate for TLS mutual authentication?

There is an additional layer of security with user authentication on the application layer. And the user authentication will be granted only if the presented client certificate is the same as the one presented on the user registration phase.

  • Enhancement compared to what? To not using authentication at all? – techraf Aug 17 '16 at 0:02
  • Enhancement to server-side certificate authentication! – Coby Yoon Aug 17 '16 at 2:19

If you self-sign with a personal CA which you then put in your trusted root, then it's reasonable. If you self-sign and then just ignore all CA errors, that's essentially useless. You offer no security in this scenario outside of passive traffic monitoring.

Adding client certificates to the mix only protects the server from unauthorised access attempts. It does little to protect against someone impersonating the server.

  • I want to generate self-signed client certificate by signing it with the client's private key. In my situation, there is no practical advantage for generating the client certificate on the server. Is there any way to avoid server's CA validation of client-signed client certificate? – Coby Yoon Aug 17 '16 at 9:45
  • The only thing I want to verify during TLS handshaking is client's ownership of the private key. – Coby Yoon Aug 17 '16 at 9:48

If you want to trust the certificate then it needs to come from a trusted entity. If you generate and vouch for the certificate yourself, your chain of trust is very shallow. You might as well ditch the mutual authentication route and just handle authentication at the application layer using an API key or some other method. A self signed certificate will always a be a superficial layer of security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.