0

I'm setting up a site for internal use and it will be served over HTTPS with a self-signed server certificate. To increase security, I want to also secure the site with client certificates.

Is there any reason to use a separate certificate authority to sign the client certificates instead of just using the server private key I already have to sign them?

migrated from serverfault.com Aug 28 '17 at 17:45

This question came from our site for system and network administrators.

1

When you talk about security, all this self-signed SSL stuff has nothing common with security. In order to implement proper SSL configuration for internal network, you have to:

  • Create your own CA server (depending on a platform, different products may be used. For example, in Windows you can use Active Directory Certificate Services, in Linux you can use CA software like EJBCA). CA certificate will be self-signed
  • Provide best security for your CA server: strict physical and remote access to the server.
  • Distribute self-signed root CA certificate to trust store on all affected clients
  • Use this CA to issue certificates to clients and web servers
  • Maintain revocation information for these certificates (CA server will periodically publish CRLs)

The reason is -- separation of concerns and security. Web servier is by default less secure. There are more chances that private key leaks from web server, because you can't guarantee adequate security for it because of web server specialization (be public). With dedicated CA you can provide better security, so less people can access it either, physically or programmatically.

If you lose SSL certificate, you can revoke it and issue a new one. Minimum server reconfiguration is required. No client reconfiguration is required. If you use CA certificate on web server, you will have to recreate every server/client certificate and reconfigure all of them in the case of key compromise.

0

Crypt32 gave information about "how". Here's a reason to do this the "right way" --

The "right way" is likely less costly than running your own CA, distributing keys, etc. "Let's encrypt" is free. A wildcard from a "cheap" SSL provider is only about $100/year and can provide a cert for all sites in a domain. Either solution is very inexpensive without running a CA server, distributing keys etc.

  • Let's encrypt is unlikely usable for internal networks, especially when private names are used. – Crypt32 Aug 29 '17 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.