I am looking into using the X.509 for mutual delegation where mutual delegation is bi-directional where an entity can only delegate a task or a set of permissions to another entity if the latter is also permitted to delegate back a different task or set of permissions to the first entity

the above is a theoretical secarino where i am trying to create a protocol to solve

this protocol is entirely theoretical but i would like to make it as real world as possible

it is for a school project

i have drawn a rough sketch of what i think is a possible solution, would a protocol like the one below work ? if not what issues would it have ?


enter image description here

Also if the above example is ok, what message would A have to send to the server to state it has roles to delegate to B etc

Anyone ?

  • The SSL/TLS protocol allows for mutual authentication. An application using this protocol could delegate tasks using the x509 cert as an identity.
    – rook
    Oct 27, 2013 at 19:01
  • Hi there, could you please elaborate on your comment, as it sounds like what i am trying to achieve thanks Oct 27, 2013 at 22:10

1 Answer 1


It is possible to establish an SSL/TLS connection with mutual authentication. In an x509 client certificate the Common Name could be a username for access control.

  • Thanks, i have authentication first via SSL to achieve mutual authentication, how would this be then used to check both can delegate tasks and then sign the x509 certif Oct 28, 2013 at 22:18
  • @user2061913 you need a PKI for that. OpenPKI is an example.
    – rook
    Oct 28, 2013 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .