Let's assume I have a device that has both client and server applications running on it at the same time. The client application for example connects to a remote secure webserver (HTTPS) that requires client-side authentication. The device also offers an own secuer webserver (HTTPS).

I'm planning to use the same certificate for client-side authentication and for the device's secure webserver as this approach only requires having one private key. Is there any disadvantage in regard to security when the same certificate is used for both use-cases?

Given that a certificate is essentially used to authenticate some user, service or system it is not uncommon that the same certificate is used as both client and server certificate on the same system or for the same service. A common use case is for example SIPS, i.e. SIP (VoIP) over TLS. Similar with SMTP typically the same certificate is used for server and client authentication when transferring a mail between MTA's (if client authentication is used at all).

Is there any disadvantage in regard to security when the same certificate is used for both use-cases?

If the same certificate is used within different services running in different security restrictions (like as different users) then sharing the certificate and private key increases the attack surface for this private key.

Is there any disadvantage in regard to security when the same certificate is used for both use-cases?

If a unique key is used for each end then a compromised key isn't sufficient to man-in-the-middle the connection. If the same key is used on both ends then you may not discover the man-in-the-middle attack.

For example consider the case of somebody getting a hold of your backups. If you used unique keys then they still aren't in a position to man-in-the-middle the connection if they didn't get a hold of the backups from both the client and the server. If you used the same key then the door is open.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.