5

I have two internal servers that are going to communicate with each other; they speak HTTPS. Is there a best practice for authenticating communications between internal servers?

Short of a best practice, my current idea is to have both the server and the "client" (really another server, but a client in the HTTP sense) verify that the other end presents a cert that is signed by a well known CA. I'm thinking of using a self-signed cert as the CA, and just distributing this cert to the machines as part of our automated deployment. (We also have a cert for example.com and *.example.com, but I'm not sure how wildly I want to distribute that cert's corresponding private key. Also, it's my understanding of centralized CA's that I can't create a foo-service.example.com cert without giving more money to and waiting on an external CA.) Is this fine?

Mostly, if the client inadvertently gets pointed at the wrong server (e.g., a DNS record gets pointed to the wrong IP) then things refuse to work. (Also, someone roguely connecting to the server shouldn't have their request accepted.)

I've thought about having the servers just have secrets, and pass them over HTTP headers, but someone would be passing their secret first without having first authenticated the other side. (Though crypto could fix this, it seemed like I'd just re-invent TLS certs.)

1 Answer 1

6

There is no need to involve a certificate authority (CA), or trusted 3rd party, when you control client and the server. By avoiding the need to have a CA, you are no longer threatened by rogue certificate authorities, and rogue certificate authority certificates.

Using two self-signed certificates it is possible to create a very strong TLS connection between two systems. Both the client and the server generate their own self-signed certificate, then the public keys are swapped.

2
  • 1
    I was planning to involve a self-signed (or otherwise) CA to make adding new servers/clients to the system easy. (There will be >1 client and server, and they may come and go.) Without using a CA, my understanding is that each server or client would need to know the certs for all of the other servers or clients.
    – Thanatos
    Sep 12, 2014 at 18:19
  • @rook would you be kind to confirm if you answer is also true for my case - stackoverflow.com/questions/45471410/…
    – ha9u63a7
    Aug 2, 2017 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .