1

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems.

My idea was that every client certificate will be rejected at the first time when connecting to the server and stored in a "reject" folder. An administrator can manually move those certificates to a trusted folder, so the client will be trusted the next time he connects. I don't want to use a third party CA and everything should be kept locally on the server side, because the server is only used internally.

I am using self signed certificates both at client and server side. Because of my little knowledge in certificate handling, my first question would be, if this approach is appropriate considering security standards?

What happens if someone gets access to my trust folder containing all trusted certificates, and uses one of them for his own client? Can he get access to my server?

0

What happens if someone gets access to my trust folder containing all trusted certificates, and uses one of them for his own client? Can he get access to my server?

The folder will only contain the public parts, i.e. the certificate with the public key. It will contain the private key for the certificate. But this is needed to use the certificate for authentication. Insofar this is not the part to worry about.

... if this approach is appropriate considering security standards?

You are essentially manage the trust into the certificates manually. This does not scale well but if you need only care about a few certificates this should not be the problem. Problems exist if the person which decides about the trust does the wrong decisions, but this is comparable to somebody issuing a trusted certificate to a party which should not get one. Similar revocation is cumbersome but this is not really better if you are using your own CA.

The main problem I see is that you don't control the information in the certificate, specifically the expiration time. In theory the client could issue a certificate which will be valid practically forever (i.e. something like valid until 2099). This will not be a problem if you expire the certificates manually anyway after some time (simple deletion) and expect the client to create a new one.

And of course, it is always a problem if you design your own process instead of using established processes since this increases the risk that you fail to notice if you do something dumb. And this can be a problem specifically in the context of security.

  • How does the folder contain the private key of the certificate? Do I need to add this too manually? – Cheesepie Mar 19 at 15:53
  • @Cheesepie: the folder with the certificates does not contain the private keys. Only the client itself has the private key to the certificate. And only the certificate (with the public key inside) is send from the client to the server. – Steffen Ullrich Mar 19 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.