4

I am currently working on a project where nearly whole communication is done using HTTPS and ActiveMQ. Servers and clients are physically in different places, different organizations and in different domains. System components will communicate using 2-way SSL (or rather TLS w/ Mutual Authentitcation? I'm not very good at naming things yet), which gives us authentication, but we'd like to use some value from certificate to perform authorization (particularly access to queues on message broker). Because of these and other requirements, we'd like to give unique URI-like identifier to each component of the system. We have decided that it will look similarly to this: "<ORGANIZATION>.backend.processor" or "<ORGANIZATION>.device.<UUID>"..

Now, my question is: should I put this identifier into DN/CN field and put DNS names (so physical addresses) into SAN (or subjAltName) of the certificate, or rather should I put it into SAN and DNS into both SAN and DN/CN field?

According to this answer, putting aforementioned identifier into DN/CN field is secure, since our infrastructure will be homogeneous and connections from external sources will be done only by browsers, which we can easily put requirements on, this should work flawlessly. But maybe we should generate two certificates for each component and use one for presenting to connecting clients (so DNSname in both SAN and DN/CN) and the other one to authorize ourselves to components that we connect to?

1

we'd like to use some value from certificate to perform authorization

You use the certificate for authentication and once you authenticated a user you can do authorization.

Sounds like hair splitting but it helps improve design.

Additionally, according to rfc3820 you can use the extKeyUsage to store some basic authorization data on the certificate itself.

For identification purposes, use of CN/SAN is fine, but you might want to use subdomains of a domain you own for them.

But maybe we should generate two certificates for each component and use one for presenting to connecting clients (so DNSname in both SAN and DN/CN) and the other one to authorize ourselves to components that we connect to?

You can use the same certificate for both purposes. If the server is compromised you'd need to revoke both keys anyway.

  • It seems that extKeyUsage allows only for a collection of oids starting with {iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3)}, at least this is what I understand. This means that there are only object without custom value. Also I don't understand what you mean by "For identification purposes, use of CN/SAN is fine, but you might want to use subdomains of a domain you own for them". I have no control of nearly all domains in use - what I want is to put user name in specific format somewhere - and my question is where should I put it. – Jędrzej Dudkiewicz Aug 31 '16 at 6:32
  • 1
    What I did in the end was to use DN/UID (OID: 0.9.2342.19200300.100.1.1) to store this value, exactly as it is suggested in an answer to this question. – Jędrzej Dudkiewicz Sep 1 '16 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.