How to implement CN/DN certificate validation between two internal servers?

Question

In an internal environment I have two Windows servers which both have Internal CA Signed SSL Certificates used to implement a Mutual Authentication HTTPS connection. Is it mandated that a CN/DN Validation (DN check against a whitelist of clients) is put in place.

1. Are CN checks already in place for any HTTPS connection as per this link?

2. How would a DN check against a whitelist of clients be implemented in this particular situation?

For point 2 I would have thought some sort of application code to check the DN against a list of valid servers. Or could you put the connecting server public certificate in your own key store and whenever a connection is made only those servers with the public certificate in your own store can make a connection?

Answer 1

I'll not be able to provide an exact answer that will "solve" this problem since in the end it's kind of a broad question that can be tackled in different ways.

For all things related to TLS implementation the OWASP Cheat Sheet is always a great reference and even starting point. It covers a lot of ground and can be useful throughout an implementation or application development.

Regarding your first question, RFC 6125 specifies procedures for representing and verifying the identity of application services in such interactions.

Section 3.1 of RFC 2818 also describes how to correctly identify a Server.

I'm not quite sure what do you mean in the second question. If you're mentioning checks during the TLS handshake or if it's related to authentication. The handshake will only work if the client and server trust each other, therefore if there isn't a trust relationship between the peers the handshake will fail, this is already covered by TLS.