We have a fairly weird integration scenario where we need to connect the following two systems:
1) Partner's API Portal - the server, which uses MASSL authentication with a requirement that the client certificate is signed by a global signing authority using SHA256 algorithm, among other things);
2) Our API Platform - the client, which we use to facilitate the development of APIs by abstracting much of the technical details. It does support MASSL, but only allows private certificates to be added as client certificates.
The last sentence is crucial. We have some public certificates that we exchanged with the partner, but we cannot front them in the API call and so we always get a SSL exception.
I have asked our partner to issue us a private certificate, but they say it is against their security policy, and suggested that we obtain one ourselves.
I think that this is impossible since CAs by definition sell public CA-signed certificates (as I checked with several of them).
My understanding is that private certificates are issued by partners that host the server application (see here for more; note that I am talking about public/private certificates, not public/private keys) and are otherwise unobtainable. We cannot use self-signed certificates also.
I guess, my question is - is this correct? Is there any way possible to get a CA-signed private certificate?