Client Certificates from Public Certificate Authorities

Question

I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs?

I see that some Public CAs (from CA/Browser Forum) offer signed "client authentication" certificates. What fields can I rely on in this case? Would I be able to just map the Subject Name to a user in my application and trust the CA/Browser bundle?

Can "Public CA 1" guarantee that "Public CA 2" will not sell the exact same certificate to a different company?

Answer 1

What fields can I rely on in this case?

It probably depends. But since there are fields in the subject for email, organization etc it is likely that these are actually filled in with the clients information.

Would I be able to just map the Subject Name to a user in my application and trust the CA/Browser bundle?

You should not just trust arbitrary bundles to authenticate your clients - see also next question. In case you want to use client authentication for external clients (not managed by you) you might trusted selected public CA. But for authentication of your companies employees it is probably a better idea to have your own company CA in order to have better control about revocation (i.e. integrated when somebody leaves the company) etc.

Can "Public CA 1" guarantee that "Public CA 2" will not sell the exact same certificate to a different company?

No. You have to decide which CA to trust for client authentication.

Answer 2

While Steffen's answer is correct, knowing that this particular project is in the EU - it is actually possible to rely on Public CAs in Europe under the eIDAS standard.

A qualified website authentication certificate (QWAC certificate) can be used for mutual TLS & Client Authentication.

A CA (or Trust Service Provider) can grant these QWAC (x509) certificates with the company's national identifier (VAT identifier) as an attribute.

This is used in the banking sector to implement PSD2.