I'm a software designer (former IT SysAdmin) trying to wrap my head around some authentication requirements in an API Specification document.
Let's say government department (abc.gov
) has created a new online web portal to receive 'incident reports' electronically via a RESTful JSON (Swagger) API secured with Mutual SSL (TLS).
Various Service Providers (we'll call one xyz.org
) are to ask their software vendors to provide an updated system that can connect to the abc.gov
API.
Our software is cloud-based (ASP.NET, IIS8, - let's say jkl.net
). Various organisations would log into our web system (username + password), then our software would have to connect to abc.gov
and impersonate (for lack of a better word) xyz.org
.
abc.gov
provides the following information along with the API specifications:
- Client certificates will need to be issued by a Trusted Certificate Authority
- Client certificates cannot be shared across different organisations.
- This client certificate needs to be shared only with the certificate's public key.
- If the same vendor is submitting incidents on behalf of multiple service providers, the vendor must use a different client certificate for each service provider.
- When client certificates expire, new client certificates will need to be issued by the Service Provider and provided to
abc.gov
, without the private keys.
From the research that I have done so far, I roughly know that we can:
- store multiple certificates,
- assign the certificate name to an organisation in our database,
- and then select the right one to present when establishing a connection. (https://support.microsoft.com/en-us/help/901183/how-to-call-a-web-service-by-using-a-client-certificate-for-authentication-in-an-asp-net-web-application)
Questions
- What I am not sure on, is where are these client certificates from?
- What type of certificate is required, and how would it work given that the domain names will not match? (i.e.
xyz.org
requests a new certificate, gives it tojkl.net
, to authenticate withabc.gov
). - Would IT staff from service providers conclude that this practice is unsafe?
Thanks in advance - looking forward to learning more about this.