0

We have a distributed product where one server acts as a 'Scheduler' of jobs and there are hundreds if not thousands of 'Agents' which receive commands from the 'Scheduler' and execute the jobs. The communication between the Scheduler and the Agents wasn't secured with TLS till now. We had a symmetric key encryption implementation to protect data over the wire.

Now, though we want to implement TLS for securing the communication between the Scheduler and the Agents. One way TLS is clear and easy to implement. We can configure the Scheduler with a TLS key pair and we can have all the Agents send a client hello to the Scheduler and verify the Scheduler's TLS public key certificate they receive back. Since most of our customers are Enterprise companies they most likely have a TLS truststore configured with their CA in all the machines were they have our Agents running. So, Scheduler authentication is easily achievable.

However, the reverse - each Agent authenticating itself to the Scheduler using TLS public key certificate has practical difficulties for us. For example, customers who have thousands of Agents face an overhead generating a TLS key pair in all the machines were they have Agents running.

Is there a standard way for us to achieve 2 way mutual TLS authentication in this case without installing TLS key pair in all the Agents ?

1
  • Is there any other way to authenticate agents? I.e. distinguish a real agent from an attacker? – Sjoerd Sep 28 '20 at 7:52
2

... achieve 2 way mutual TLS authentication in this case without installing TLS key pair ...

Obviously you cannot do authentication with a client certificate without having a client certificate installed. But you basically face the same problem with any other authentication method: if you want to authenticate each agent then somehow you have to setup each agent with agent-specific credentials first and also associate these credentials with the agent in the scheduler. It does not matter if these are tokens, passwords or key pairs.

1
  • Thanks. We ended up implementing mutual TLS and left the TLS cert and keystore management to the customers. – Ragavan P Jul 23 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.