When I am trying to call a third-party Api, I am given 3 files generated by the Api site: root.cer, client.pfx and server.pfx.

I am using Windows system so I installed root.cert in Trusted Root Certification Authorities using mmc (Microsoft Management Tool). I know by this step I installed a CA in my machine but I still cannot call the Api from my machine. So I also installed client.pfx in personal mmc too and after that I am able to call Api sucessfully.

I am confused that what is the use of client.pfx. Here is my understanding of the whole process:
I know I am trying to connect to Api site by SSL/TLS. Every time I connect to the site, it will provide a certificate and then I verify the certificate by CA I installed in my machine using root.cert. After that, I am able to confirm the public key belongs to the site to which I am trying to connect and then I should be able to send messages encrypted by the public key to the site.

My questions are:

  • What is use of file client.pfx and why I must install that?
  • What is use of file server.pfx that is not used in the my scenario?

what is use of file client.pfx and why I must install that?

SSL/TLS uses (almost always) server certificates to authenticate the server (which you validate using the root.cert). It can also optionally require that the client authenticates against the server using a certificate (mutual authentication). This is done in your case and the client.pfx file contains the client certificate and the associated private key. Only the client showing that it owns this certificate is accepted by the server.

what is use of file server.pfx that is not used in the my scenario?

This is probably the certificate for the server. I have no idea why you were given this file (since you shouldn't need or have access to the servers private key) but you might use the servers certificate to make your application only accept this specific certificate for the server and not all certificates issued by the CA which match the servers name. This is also called certificate pinning or public key pinning.

  • For pinning, wouldn't just the public chain be sufficient? .pfx files usually contain the private key as well, and giving it to clients seems unnecessarily dangerous. – grawity Mar 21 '18 at 7:47
  • @grawity: for certificate pinning the server certificate would be sufficient. The private key is not needed for this. I've made the answer more clear in this regard. – Steffen Ullrich Mar 21 '18 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.