Usage of same certificate for client and server authentication

Question

Let's assume I have a device that has both client and server applications running on it at the same time. The client application for example connects to a remote secure webserver (HTTPS) that requires client-side authentication. The device also offers an own secuer webserver (HTTPS).

I'm planning to use the same certificate for client-side authentication and for the device's secure webserver as this approach only requires having one private key. Is there any disadvantage in regard to security when the same certificate is used for both use-cases?

Answer 1

Given that a certificate is essentially used to authenticate some user, service or system it is not uncommon that the same certificate is used as both client and server certificate on the same system or for the same service. A common use case is for example SIPS, i.e. SIP (VoIP) over TLS. Similar with SMTP typically the same certificate is used for server and client authentication when transferring a mail between MTA's (if client authentication is used at all).

Is there any disadvantage in regard to security when the same certificate is used for both use-cases?

If the same certificate is used within different services running in different security restrictions (like as different users) then sharing the certificate and private key increases the attack surface for this private key.

Answer 2

Is there any disadvantage in regard to security when the same certificate is used for both use-cases?

If a unique key is used for each end then a compromised key isn't sufficient to man-in-the-middle the connection. If the same key is used on both ends then you may not discover the man-in-the-middle attack.

For example consider the case of somebody getting a hold of your backups. If you used unique keys then they still aren't in a position to man-in-the-middle the connection if they didn't get a hold of the backups from both the client and the server. If you used the same key then the door is open.