My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL.
The clients would use a library provided by us to connect to the service. This Java based library would perform mutual SSL using keystores and truststores. So both server and clients are in our control. To emphasize, there are no browsers involved in the whole communication.
In order to successfully perform mutual SSL authentication, they must trust a certificate provided by our cloud service. This certificate could be:
- A public CA certificate (like Comodo, Verisign etc.). But asking clients to trust a public CA would allow possibility of man in middle attacks as someone else can use a different certificate signed by same CA to fool the clients.
- Private Root CA of our own. This would involve building our own PKI service and securing the private key et al. Does our situation justify opting this route?
- Self-signed certificate used by both server and clients. One problem I see with this solution is that when the certificate expires, all clients across tenants will have to reconfigure new certificate at the same time. That would be unacceptable.
Another option I have come across is to use some sort of SSL pinning (certificate or public key) which will override the trust chain. This is not an easy solution to implement.
What is the recommended solution?