Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm setting up a site for internal use and it will be served over HTTPS with a self-signed server certificate. To increase security, I want to also secure the site with client certificates.
Is there any reason to use a separate certificate authority to sign the client certificates instead of just using the server private key I already have to sign them?
When you talk about security, all this self-signed SSL stuff has nothing common with security. In order to implement proper SSL configuration for internal network, you have to:
The reason is -- separation of concerns and security. Web servier is by default less secure. There are more chances that private key leaks from web server, because you can't guarantee adequate security for it because of web server specialization (be public). With dedicated CA you can provide better security, so less people can access it either, physically or programmatically.
If you lose SSL certificate, you can revoke it and issue a new one. Minimum server reconfiguration is required. No client reconfiguration is required. If you use CA certificate on web server, you will have to recreate every server/client certificate and reconfigure all of them in the case of key compromise.
Crypt32 gave information about "how". Here's a reason to do this the "right way" --
The "right way" is likely less costly than running your own CA, distributing keys, etc. "Let's encrypt" is free. A wildcard from a "cheap" SSL provider is only about $100/year and can provide a cert for all sites in a domain. Either solution is very inexpensive without running a CA server, distributing keys etc.
