I'm developing a custom VPN solution that needs to support SSTP for Windows clients. For this, my server needs to authenticate itself using a certificate during the SSL handshake. As usual, Windows will then look through its local set of trusted certificates and decide whether to accept or reject the connection.

Since this project currently doesn't have the budget to pay for an official certificate (from Verisign or whoever), I would like to use a self-signed one for now. Unfortunately, this means I will need to ask my users to install this certificate so that Windows can successfully authenticate my server.

I have two specific questions about this scenario:

  • If I ask users to install this self-signed certificate into their "Trusted Root Certification Authorities" store, does this pose a security risk (of ANY kind!) for them? For example, if someone were to get a hold of the private key of my certificate, could they use it to impersonate any other entity (like Google or Facebook or a bank) by simply signing their own certificate for those names and having it point to my root certificate, or could they only impersonate my server?

  • If so, is there a way to tell Windows to only use my certificate to authenticate my SSTP server, but not to authenticate any other https or other connections? Preferably, this would be an action that the users can easily take or verify rather than just some setting inside the certificate.

up vote 1 down vote accepted

You do not want to create a distribute a CA certificate. This would make you take too much responsibility as anyone getting its hand on you CA private key will be in measure to intercept most TLS communications from your all your customers by forging third-party certificates on the fly.

What you want to distribute is only a self-signed, end-user certificate with the Common Name matching your host name as seen by the customers. Such certificate will be safe to distribute as it will only be usable to secure the communication with your server.

Obviously, only distribute your public certificate (usually this is a .pem or .crt file), keep your private keys private.

  • Just to make sure I understand: If I distribute a CA certificate, an attacker could intercept pretty much ANY TLS connection on the user's system if they had access to my private key somehow? They could, for example, simply generate a new certificate for wellsfargo.com for their own server and sign it with the private key of my CA certificate and, since that is installed, the browser will simply say that everything is fine, even when the user is looking at a phishing version of the page on the attacker's server? – Markus A. Jul 29 '17 at 21:59
  • And this is definitely NOT possible with a self-signed, end-user certificate, no matter where the user installs it? Is there a way for the user to distinguish the two before making the install decision? I want to be able to assure my users that installing the certificate is 100% safe and does not compromise their system in any way. – Markus A. Jul 29 '17 at 21:59
  • Your first comment is right. As soon as a certificate is set as a trusted certification authority on a system, it becomes a certification authority for anything. New systems such as HTTP public key pinning (HPKP) are being developed to counter this but it is currently quite heavy to implement and is therefore mostly reserved to protect high-value targets. – WhiteWinterWolf Jul 30 '17 at 8:38
  • For your second comment, someone more well-versed in Windows systems administration than me could more likely bring a more useful answer. IMHO I don't think Windows certificate management GUI to be very user-friendly. When opening the certificate, below the Certificate details tab, near the end there should an Enhanced key usage section. CA certificates will contain the Certificate signing usage while end-user certificate will not. When importing the certificate, the end-user certificates must not be imported in any "Certification Authorities" stores. – WhiteWinterWolf Jul 30 '17 at 8:48
  • @MarkusA. Normally Windows should be able to select a store automatically relying on the certificate property, It is possible (even recommended) to open Windows certificates manager to double-check where the certificate has been stored, execute the certmgr.msc command to open it. It is possible to remove the certificate from there at any time if anything seems fishy. – WhiteWinterWolf Jul 30 '17 at 8:52

Unless you include your private key or something as part of the certificate package for a trusted root CA cert that you deploy to the Windows hosts; the private key would probably compromised in some other fashion.

With that said, if it is a signing intermediate or internal CA based cert; someone who captures a signing cert could use it and perform a man-in-the-middle to do 'trusted' ssl decryption on the victim network or create 'trusted' spoofed phishing sites or other malicious browser friendly content for your users.

If your self signed cert is purely a public cert for trust authentication only; in general you should be fine as long as an attacker decides not to take it and spoof your web server.

In either scenario, if this is happening in a test/dev environment for a proof of concept-- you probably have bigger problems to worry about regarding your cyber security.

If you're really paranoid about alternative authentication; you could add requirements for the clients to have a client-side certificate that your server knows about (mutual authentication) via TLS. There's also compensating controls where maybe your network security infrastructure only allows SSTP over SSL/TLS traffic to be accessed on a specific VLAN or static IP/MAC pairing.

  • I'm actually not really too worried about the authentication provided by the certificate. I have full control over the data link between the client and the server, so I know they are trusted anyways. I just haven't found a way to tell Windows not to worry about authenticating the server. That's the only reason I even need the certificate: to please Windows. What I don't want to do, though, is have the process of installing the certificate onto a user's computer compromise their system in any way, even if somebody should get a hold of my certificate's private key somehow. – Markus A. Jul 29 '17 at 21:57

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.