We have a fairly weird integration scenario where we need to connect the following two systems:

1) Partner's API Portal - the server, which uses MASSL authentication with a requirement that the client certificate is signed by a global signing authority using SHA256 algorithm, among other things);

2) Our API Platform - the client, which we use to facilitate the development of APIs by abstracting much of the technical details. It does support MASSL, but only allows private certificates to be added as client certificates.

The last sentence is crucial. We have some public certificates that we exchanged with the partner, but we cannot front them in the API call and so we always get a SSL exception.

I have asked our partner to issue us a private certificate, but they say it is against their security policy, and suggested that we obtain one ourselves.

I think that this is impossible since CAs by definition sell public CA-signed certificates (as I checked with several of them).

My understanding is that private certificates are issued by partners that host the server application (see here for more; note that I am talking about public/private certificates, not public/private keys) and are otherwise unobtainable. We cannot use self-signed certificates also.

I guess, my question is - is this correct? Is there any way possible to get a CA-signed private certificate?

  • Do you mean a client-side certificate? superuser.com/questions/353038/… – Lucca Ferri Feb 4 at 15:49
  • 1
    I would expect that your partners API portal and your own API are different servers which means different TLS connections which means that you can use different client certificates for each of these connections. If this is the case I don't understand where you have a problem. And what exactly do you mean with private certificate? A self-signed one, or one issued by your own company-specific CA or any certificate which is not issued by a public CA or ....? – Steffen Ullrich Feb 4 at 15:59
  • Yes, I mean a client-side cert. – Djordje Rakic Feb 5 at 7:49
  • @SteffenUllrich, I believe the private cert is either a self-signed one or company-specific CA, based on what I've seen and what is written in this [article ](ibm.com/support/knowledgecenter/en/ssw_ibm_i_73/rzahu/…). The problem is that they will not allow self-signed certs, so I need to find some way to get a private certificate that would satisfy all of their requirements but still remain private. I don't believe this is possible. – Djordje Rakic Feb 5 at 7:56
  • @DjordjeRakic: If the server is guaranteed to always have the latest CRL (as you seem to assume in your linked question) then the expiration date does not really matter. But this assumes that whenever the CA revokes a new certificate it gets automatically pushed to all systems which need it and that it is not possible to give an outdated (incomplete) CRL to a server. Expiration date is more relevant in a scenario where a new CRL is pulled when needed. – Steffen Ullrich Feb 5 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.