pki infrastructure for REST API

Question

My question is based on to secure REST API's. We have to publish a REST API and we want only certain consumers to consume the API. I was thinking of one way is to use asymmetric encryption.

The steps I was about to follow:

1. Generate a public/private key pair
2. Export the public key in the form of X.509 certificate
3. Share the public key with the client
4. Client to use public key to encrypt data and make a POST Request on the API to send the encrypted data
5. On the server, I'll decrypt the data using my private key and then store in the database

If an SSL certificate is already installed on the webserver and any API has to be called using HTTPS, is it not doing the same thing as per above?

That is where my confusion lies. Can someone help?

Answer 1

What you are proposing is not designed to solve the problem. What you have described is similar to what SSL/TLS, S/MIME do. It provides data privacy, but not client authentication.

For certificate-based authentication, you have to ask approved API consumers to generate CSR and sign them by your private and approved CA. Then configure web server to require client certificate and configure authentication/authorization middleware to check the certificate to be signed by approved issuer. You may need to store an identity database to map certificates to identities and audit purposes. For example, if you need to revoke access for specified user.

There are a lot of online articles on Client certificate authentication subject for very different platforms. You can just query your favorite search engine by specifying your web server product.