I'm a software designer (former IT SysAdmin) trying to wrap my head around some authentication requirements in an API Specification document.
Let's say government department (
abc.gov) has created a new online web portal to receive 'incident reports' electronically via a RESTful JSON (Swagger) API secured with Mutual SSL (TLS).
Various Service Providers (we'll call one
xyz.org) are to ask their software vendors to provide an updated system that can connect to the
Our software is cloud-based (ASP.NET, IIS8, - let's say
jkl.net). Various organisations would log into our web system (username + password), then our software would have to connect to
abc.gov and impersonate (for lack of a better word)
abc.gov provides the following information along with the API specifications:
- Client certificates will need to be issued by a Trusted Certificate Authority
- Client certificates cannot be shared across different organisations.
- This client certificate needs to be shared only with the certificate's public key.
- If the same vendor is submitting incidents on behalf of multiple service providers, the vendor must use a different client certificate for each service provider.
- When client certificates expire, new client certificates will need to be issued by the Service Provider and provided to
abc.gov, without the private keys.
From the research that I have done so far, I roughly know that we can:
- store multiple certificates,
- assign the certificate name to an organisation in our database,
- and then select the right one to present when establishing a connection. (https://support.microsoft.com/en-us/help/901183/how-to-call-a-web-service-by-using-a-client-certificate-for-authentication-in-an-asp-net-web-application)
- What I am not sure on, is where are these client certificates from?
- What type of certificate is required, and how would it work given that the domain names will not match? (i.e.
xyz.orgrequests a new certificate, gives it to
jkl.net, to authenticate with
- Would IT staff from service providers conclude that this practice is unsafe?
Thanks in advance - looking forward to learning more about this.