I want to build Server (My) to Server (Other Client parties) web service and I want to add security layer for client verification.

Do I need to force clients to create x509 Certificates or RSA key pair is enough ? As I guess x509 contains RSA public key and Certificate data, so verification process is same.


If you just want to make sure that the client owns a specific private key than it is enough to have a key based authentication. This is done by SSH for example.

But this requires that each server knows the public keys for each client which might want to authenticate there. This might work for a few clients but does not scale well for lots of clients or multiple servers. In this case a PKI (public key infrastructure) is preferable with some central certificate authority (CA) issuing all the certificates and the servers can simply accept all certificates issued by this CA (but need to check also expiration and revocation) and get the information about the client from the subject. While this is more effort in the initial setup it scales better if many peers are involved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.