1

For sending soap messages to a webservice we need to include a client authentication certificate with these messages. Normally we simply created a self signed client auth. certificate (with as a common name the name of that particular client, not domainname). However we are asked to not self-sign the client auth. certificate anymore.

I am lost in how I can generate a similar client authentication certificate, but from a public and 'known' CA, but without a domain name. Because from what I've seen most CA's validate on domainname-ownership.

Any ideas?

Improve this question
2
  • Since a certificate need to be verified the server should have more specific requirements about the certificate issuer and content of the certificate than just "not self-signed". Please provide the relevant requirements. Also, the information "web-service" makes it not clear if this is about a client certificate in the context of TLS (i.e. mTLS) or for signing the soap message.
    – Steffen Ullrich
    Jan 26 at 16:34
  • Who owns the web service? “However, we are asked to not self-sign the client auth. certificate anymore.” By whom?
    – beroal
    Jan 28 at 11:58

2 Answers 2

Reset to default
0

This is mutual TLS. There are not a lot of standards on how this is done. The server has a list of CAs that it trusts. Your client cert must come from one of those CAs or chain up to one of them. Sometimes the server will advertise the list of client hints, some hide them. If hidden, you have to talk to the server owner.

Running 'openssl s_client -connect server:port' will give you some data. Client hits would look like this

---
Acceptable client certificate CA names
C = US, ST = California, L = San Francisco, O = "company.com, inc.", CN = company.com Root CA 1
C = US, ST = California, L = San Francisco, O = "company.com, inc.", CN = company.com Internal Root CA 4
C = US, ST = California, L = San Francisco, O = "company.com, inc.", CN = company.com Internal Root CA 3
Requested Signature Algorithms: Ed25519:Ed448:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA1:RSA+SHA1
Shared Requested Signature Algorithms: Ed25519:Ed448:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
Improve this answer
5
  • Yes indeed I am referring to mutual TLS or 2-way SSL, but..how do I create a certificate without a domain name (or email) from a known CA...do you know any CA that offers this or is this not possible without self signing?
    – user2713516
    Jan 26 at 19:35
  • Every CA has different enrollment rules, so you have to start with the supported CAs.
    – markgamache
    Jan 26 at 20:29
  • I have decided to designate a subdomain of an existing domain to use as a common (and DNS) name for creating a client auth. certificate. This way I can just create a new SSL cert on that particular domain including validation. Not really what I was looking for but based on the answers the best I can get.
    – user2713516
    Jan 27 at 10:51
  • The name is not enough. The cert must be issued by an approved CA. Making a cert with an arbitrary name is easy, but it will not have the hierarchy of trust needed.
    – markgamache
    Jan 28 at 19:22
  • correct, but by using our own (owned) domain, I can get validated by an approved CA, which turned out hard/impossible without using a self-owned domain. So I will just create a certificate (using sectigo for instance) as if I would use it for my website domain, but then with the additional client auth property.
    – user2713516
    Jan 29 at 12:03
1

It sounds like what you are looking for may be an S/MIME certificate. S/MIME certificates are typically used to encrypt and sign email messages, but an S/MIME certificate can also be used as a client certificate for authenticating a client with a web server through TLS.

Most well-known certificate authorities (e.g. Sectigo, GlobalSign, etc.) offer S/MIME certificates. To verify that the requestor has access to the email address in the CN and or SAN of the certifciate, the CA will send a challenge to that email address.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.