1

Is there any security enhancement when I use self-signed client certificate for TLS mutual authentication?

There is an additional layer of security with user authentication on the application layer. And the user authentication will be granted only if the presented client certificate is the same as the one presented on the user registration phase.

2
  • Enhancement compared to what? To not using authentication at all?
    – techraf
    Aug 17, 2016 at 0:02
  • Enhancement to server-side certificate authentication!
    – Coby Yoon
    Aug 17, 2016 at 2:19

2 Answers 2

1

If you self-sign with a personal CA which you then put in your trusted root, then it's reasonable. If you self-sign and then just ignore all CA errors, that's essentially useless. You offer no security in this scenario outside of passive traffic monitoring.

Adding client certificates to the mix only protects the server from unauthorised access attempts. It does little to protect against someone impersonating the server.

2
  • I want to generate self-signed client certificate by signing it with the client's private key. In my situation, there is no practical advantage for generating the client certificate on the server. Is there any way to avoid server's CA validation of client-signed client certificate?
    – Coby Yoon
    Aug 17, 2016 at 9:45
  • The only thing I want to verify during TLS handshaking is client's ownership of the private key.
    – Coby Yoon
    Aug 17, 2016 at 9:48
0

If you want to trust the certificate then it needs to come from a trusted entity. If you generate and vouch for the certificate yourself, your chain of trust is very shallow. You might as well ditch the mutual authentication route and just handle authentication at the application layer using an API key or some other method. A self signed certificate will always a be a superficial layer of security.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .