1

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results.

I need to ensure Encryption, data integrity, and authentication.

Let's say I create a self signed certificate. I bind it to the 2nd application and also add it to the certificate storage of my first application (and also add it on my webclient).

Will this be enough (security wise)?

Improve this question
1
  • Just checking: is there some reason you can't get a certificate from a trusted Certificate Authority for your second app's server? Then not only would you not have to add anything to the first app's host, you also would be able to establish a secure connection from other hosts too. There are free CAs that generally work fine, such as LetsEncrypt; you don't need an extended-validation certificate or anything, so the free ones should be fine.
    – CBHacking
    Feb 3 at 18:00

1 Answer 1

Reset to default
1

In using a self-signed certificate, you essentially face the same risks as a certificate authority. Mainly, you need to make sure your private key is kept secure. This is ensured using a number of methods.

Firsty, use a HSM (hardware security module) to store your private keys and perform encryption. Your cloud hosting provider may provide this service.

Secondly, the certificate you use for TLS encryption will typically be at the third level in a certificate chain. This stackexchange page, for example has a certificate chain like this:

DigiCert Root CA (25 years before expiry)
    |
    DigiCert Server CA (15 years before expiry)
        |
        *.stackexchange.com (1 year before expiry)

This makes it easy to rotate keys, before they get leaked or cracked, without having to regularly update the certificate store. Of course, since you have control over the certificate store, you can change the certificates as often as you like without need for such a chain.

Also, make sure you're always using the latest version of TLS.

Improve this answer
1
  • ...most cloud providers won't make you manually deal with an HSM, you'd just have to upload the certificate itself. No reputable tool for certificate generation is going to use current system time for seeding random, specifically because of the issue you list - all modern OSs have utilities for getting much better sources of random data. And the ValidFrom field doesn't have to be the issue time - and in fact, it probably isn't, if you're planning to rotate your keys regularly (ie, you would issue keys hours or days before valid).
    – Clockwork-Muse
    May 24, 2019 at 17:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .