0

Imagine server A calling server B over SSL and that both servers have SSL certificates installed.

Later server A again calls server B.

Is there a way for server B to know that server A is the same server in both calls without a client certificate?

In my application I issue a shared security token in the first call. But in the second call I would like to know that the security token hasn't been copied to and is now sent from a third party C, so I'd like to add an additional check that A is still A (not necessarily the same physical server but it has the 'A' SSL certificate installed). I cannot enforce the use of client certificates. I cannot rely on the IP address because they are volatile.

As far as I understand I can get the server A hostname from the [EDIT: encrypted HTTP] header. But I suspect an attacker could spoof the hostname and just insert HTTP host header 'A' even though it is C?

I also suspect that the calling server A isn't using its server certificate when establishing a connection to server B?

I would like to hear if I am wrong in my assumptions and / or if anyone has any suggestions other than using a client certificate

P.S. A solution could be that B could call back to A over SSL and ask if A just posed a question, but that's rather involved and I'd like to avoid such a step.

3
  • 1
    "As far as I understand I can get the server A hostname from the SSL header." - no, you can't. "I also suspect that the calling server A isn't using its server certificate when establishing a connection to server B?" - that would be the client certificate you explicitly don't want to use. Apr 1, 2021 at 17:45
  • 1
    Note that server A is actually a client when connecting to B. "server" and "client" have a variety of meanings, depending on the context. Sometimes it refers to the hardware, sometimes service provider vs. user, sometimes accepting connections vs. connecting. You are basically mixing up meanings here and this is causing the confusion you have. So server A connecting to server B means A as TCP client connecting to B as TCP server. But at the same to both A and B provide services to others, i.e. function as servers at this level. Apr 1, 2021 at 17:49
  • Brilliant. It's a good alternative to my PS (not as secure but much much more convenient). Thank you 🙏 Apr 3, 2021 at 0:44

2 Answers 2

0

Immediately after server B receives a request from server A (and before responding to the request), server B can initiate an HTTPS connection back to server A (based on the IP address that the the initial request from server A originated from). Assuming the SSL/TLS handshake is completed successfully, this will result in:

  1. server B receiving server A's certificate
  2. server A proving that it has the private key corresponding to the public key in its certificate

At this point (assuming that the steps above were completed successfully), server B can verify that the certificate presented by server A is the same as the one that server A presented in previous requests - even if previous requests from server A originated from a different IP address.

2
  • Intriguing, very close to my "PS". But how would you use the IP address to call back to server A if there are multiple secured domains on server A? (e.g. acme1.com and acme2.com). Apr 2, 2021 at 22:21
  • In that case, the callback to server A would have to be done using SNI, using server A's IP address and the hostname provided by server A in the initial request. This would mean that acme1.com could spoof a request from acme2.com, being that both sites are hosted on the same server with the same IP. So, it wouldn't be recommended in shared hosting situations where some sites on the server are not trusted. But, it prevents spoofing by other servers which have different IP addresses.
    – mti2935
    Apr 2, 2021 at 22:50
0

What you are talking about is called authentication: A needs to prove that it is really A.

One of authentication methods can be authentication based on client certificate (when A want to use some service of B, the we say that A is a client of B).

Another method, much simpler, can be usual User/password authentication. The services that B provides should require authentication. All possible clients should be known to B, e.g. should be contained in some registry or database on B, so that B can check if particular user is known and that the password is valid.

If there are more clients that can call services of B, every client should get its own user/password.

Thus, when B receives some request, it checks credentials and, if check was successful, executes the requested operation, otherwise returns some error.

3
  • Thanks! As I mentioned I can't demand a client certificate. I have a shared secret rather than user/pass (end result is the same IMO). But I wanted an extra check to ensure that the shared secret hadn't been copied / hacked to a third party C. Which obviously is not solved by the comments above. Apr 2, 2021 at 22:16
  • 1) "I can't demand a client certificate." - You don't have to. You can create a self-signed certificate. Install it on A and use it for client authentication. On B, register this certificate as a trusted. Also, configure B to use certificate-based authentication. 2) What you should not do: Don't use server certificate of A for any other purposes. Creating dependency between 2 different goals is not good.
    – mentallurg
    Apr 3, 2021 at 0:46
  • The other server isn't mine to control :-) That's why I can't demand anything from it. :-) Apr 4, 2021 at 4:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .