I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our company for verification. That would seem to be easy enough for a single server (JBOSS server, BTW), but how do I generate a CSR for use on multiple requesting servers behind a single external NAT? Does it make a difference which machine I generate the keys on as long as the signed cert is loaded onto all machines that can make requests to the vendor so that they all present teh same client cert? Thanks in advance for any help you can give on this.

| improve this question | | | | |
  • 'give them a cert' suggests maybe they will manually trust a self-signed cert you create yourself, whereas the usual way is for you to obtain a cert from a CA which is automatically accepted because it is from an acceptable CA. The procedures for these two methods are rather different but yes in either case you can use the same cert PLUS chain if any AND privatekey on multiple requesters IF either their system accepts concurrent connections with the same id or you avoid making connections concurrently. NAT shouldn't matter unless they are checking IPaddr. – dave_thompson_085 Sep 27 '17 at 6:53
  • Thanks for taking the time to respond. They do indeed want a cert signe dbe an external trust authority like Verisign. They are not interested in IP in their PROD environment, only in their nonPROD where they whitelist IPs instaed of requiring a client cert. Appreciate the response! – Matt Foerschler Oct 4 '17 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.