I had a friend say:

We're securing our microservice with an HMAC derived from the private key in the jks file. [Where client and server shared the same private key]

I can understand the situation where you have an HMAC from a secret that is short lived - such as one derived from Hashicorp Vault.

But if the HMAC has the same lifetime as the private keys - why not just secure the microservice using SSL based on the private keys you've already installed?

My question is: Is there value to signing microservice calls with an HMAC derived from the same private key?

  • What private key? Typically a private key would only be known by one end. If the client generates the hash, the server has no way to verify.
    – paj28
    Mar 23, 2017 at 10:19
  • Thanks - that's helpful. I've clarified the question to state that both client and server share the private key.
    – hawkeye
    Mar 25, 2017 at 3:02

1 Answer 1


If client and server share the same private key, private key basically turns into as a symmetric secret, thus nullifying any use-case relevant for SSL, or, FWIW, any signing scheme.

It's basically integrity without authenticity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .