Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is there any security enhancement when I use self-signed client certificate for TLS mutual authentication?
There is an additional layer of security with user authentication on the application layer. And the user authentication will be granted only if the presented client certificate is the same as the one presented on the user registration phase.
If you self-sign with a personal CA which you then put in your trusted root, then it's reasonable. If you self-sign and then just ignore all CA errors, that's essentially useless. You offer no security in this scenario outside of passive traffic monitoring.
Adding client certificates to the mix only protects the server from unauthorised access attempts. It does little to protect against someone impersonating the server.
If you want to trust the certificate then it needs to come from a trusted entity. If you generate and vouch for the certificate yourself, your chain of trust is very shallow. You might as well ditch the mutual authentication route and just handle authentication at the application layer using an API key or some other method. A self signed certificate will always a be a superficial layer of security.
