1

Certificate authentication on https has always been one of my huge knowledge gaps ,and was trying to fill it today.

I have made some progress on the client side certificate authentication but however there's some fundamental question that can't get my head around.

I have worked with third parties that use to send the certificate (and passphrase) over and then we were able to start using their services. Unfortunately I wasn't involved at all in the process so not even sure if it's my misunderstanding. Assuming that was correct, please let me know if not, my questions are

  • Do you exchange the pfx, with the private key as well as the certificate?
  • If I had a certificate signed by a trusted CA why not just send that one and the server would just need to validate it? is the case that the exchanges certificates are ad-hoc ones and they just need to validate it's issued by them?
  • Is this exchange where the Certificate Signing Request can be used?

I understand the question is both simple and vague but can't really see the use case of this exchange, from what I have been reading for a while

Thanks

2

Do you exchange the pfx, with the private key as well as the certificate?

Only the client certificate is provided to the server. And the client proves to the server that it has access to the private key by signing some data which are at least in part provided by the server. This is actually very similar to how it works with the server certificate.

If I had a certificate signed by a trusted CA why not just send that one and the server would just need to validate it? is the case that the exchanges certificates are ad-hoc ones and they just need to validate it's issued by them?

"Trusted CA" is what the server considers as trusted for the authentication of the client. This often does not mean that the certificate was issued by a publicly trusted CA as is preinstalled in the systems but by a private CA which the server considers as trusted for the purpose of client authentication.

Is this exchange where the Certificate Signing Request can be used?

A certificate signing request (CSR) is used when applying for a certificate. In case of a private CA trusted by the server you need to send your CSR to this private CA which then issues a certificate based on the CSR. Note that using a CSR is not mandatory. Instead it might be that you just get issued a personalized smartcard with a certificate (and the matching key) already on it without creating a CSR.

| improve this answer | |
  • Thanks, when asking about exchange the pfx was trying to say what the server shares with the client, not what was exchanged in the network traffic. Not really sure yet as you mention data partially provided by the server, but I undersand you that at least the private key has to be "pre" shared – mitomed Jan 1 at 17:07
  • 1
    @mitomed: The server is the endpoint of a connection. It "shares" nothing with the client. A company might operate the server, might operate a private CA to issue client certificates and might configure the server to trust certificates issued by this private CA for client authentication. The client as person (not as software like browser) interacts only with the CA: it might request a signed certificate using a CSR in which case the private key is kept secret by the client or it might just get a smartcard with certificate and key in which case the private key is protected by the smartcard. – Steffen Ullrich Jan 1 at 17:18
  • "I undersand you that at least the private key has to be "pre" shared" - no. The private key is not shared, that's why it is called private key or also secret key. – Steffen Ullrich Jan 1 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.