1

My Server is Windows 2008.

Mr. X is accessing my web server using Mr. X's certificate. In that time, an outsider is also trying to access my server using Mr. X's certificate (somehow he got it). Is it possible to disable multiple access using one certificate?

N.B: I mapped 900 certificates to my SSL-enabled server which was one-to-one mapping. No one else will be allowed to access my server. I used one user account to map all 900 certificates. But while testing I found that I can access my server from two different PCs using one client certificate at the same time. How can I resolve it? It would great if anyone can help me regarding this.

  • Is it possible to put a passphrase on it? it becomes something you have and something you know then. – ndrix Mar 11 '14 at 5:58
  • Hi m1ke, Thanks for your interest. Yes it's possible to set passphrase. But it didn't solve my issue. I think technically its possible to restrict multiple access. But I don't know how. – S.R.K Akash Mar 11 '14 at 6:36
  • 2
    What kind of service are you trying to protect. Different services will have different ways to implement this technically. – Dog eat cat world Mar 11 '14 at 7:14
  • I don't understand what you're trying to achieve. What if an outsider is using X's certificate when X tries to connect? You can't know which one is the correct one, so why arbitrarily reject one and allow the other? And what if X is logging in from different machines, e.g. due to using Tor or due to a flaky ISP that keeps changing IP addresses or because he's roaming on a mobile device? – Gilles Mar 11 '14 at 10:47
  • Thank you all for commenting. @ Dog eat cat world , I want to protect my SSL server from multiple access at the same time. In my server there is application hosted. After Client certificate holders authenticating them using certificate, they will be able to see my application log in page. Then they need to give there user name and pswd to login the application. I want to protect this log in page from multiple access at the same time. Someone told me that there is a way using application bindings but i want to do it webserver layer. – S.R.K Akash Mar 11 '14 at 12:04
1

I'm not 100% if this can be done from the webserver layer, but your application itself can verify who is logged in.

Using PHP, this can be done using the following $_SERVER vars. For example - in PHP-; using $_SERVER["SSL_CLIENT_S_DN_Email"], your application can determine if a particular user's email address (or SSL_CLIENT_M_SERIAL for the cert's serial number) is logged in already and take action (deny access, raise warning, ...) if a new "session" is initiated. You'd need to keep track whether a user is "still logged in" though, usually through a timeout on last HTTP request.

Hope this helps,

  • 1
    This seems the most logical. If the login can only be successful if the cert matches the login, then you simply handle the authenticated sessions at the application level. Putting the control any further down the stack could result in @Gilles' issues in his comment above. – schroeder Mar 11 '14 at 16:36
  • 1
    Since http is a unstateful protocol, it would be reasonable to track sessions with a session cookie. Some logic on the serverside can count active sessions, and block new sessions if there already is one. – Dog eat cat world Mar 11 '14 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.