0

Is it possible to verify the certificate of a server and pass the certificate over to another software component over https for it to use this as trusted certificate for further communications (using CURL)?

This sounds wrong to me. Please explain.

Can the software component verify the certificate it has received from another software component is same as the one from the web server? It is really not using the chain of trust.

2 Answers 2

2

Can the software component verify the certificate it has received from another software component is same as the one from the web server?

It might trust the other software component that this is the correct certificate but it cannot verify this.

2
  • Is it right to do it?
    – ProgramCpp
    Commented Sep 7, 2017 at 14:56
  • @ProgramCpp: If the component doing the initial connection and forwarding the certificate to curl can be trusted, if the way this forwarding is done can be trusted and if it can be trusted that curl is properly configured with this certificate then this might work. There is a risk of wrong implementation or hacker interaction involved in all of these steps so the total risk is not zero. But it might be acceptable or it might even be the lower risk compared to disabling certificate validation at all in curl. I cannot say if this is the best optionsince I don't know the other options. Commented Sep 7, 2017 at 15:03
1

Yes, its possible that something sitting in the middle of an exchange can choose what data to pass across to the other side. Whether the functionality to do this is in available in your software stack is another question.

Both stunnel and mod_ssl can pass on information extracted from the certificate to other components - but this is information derived from the certificate rather than the raw certificate itself.

It is really not using the chain of trust.

No - Anything which encrypts data to be decrypted by a certificate must be in posession of the private key for that certificate. If you want a chain of trust then you need to re-encrypt the data using a new key at the node where you decrypt the incoming stream.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .