I have a project that require client application to register and then use the services. I would like to do the following:

  1. A client app sends a request with IP, domain name, etc. to my REST service
  2. The rest service creates a new certificate based on the parameters and then sends back to the app.
  3. The application will then send the thumbprint of the certificate to prove it is genuine.
  4. On receiving the certificate, I will use the server certificate which has private key to validate the received input.

I have been searching in the internet and only found that the certificate were created manually. Also, there was no way to generate a certificate on runtime

Please suggest the right practice. I am a .net developer.

  • This is broken. Do not do this. – AJ Henderson Dec 8 '14 at 17:16
  • Resetting close votes so this doesn't wrongly get migrated to the wrong site. It belongs here. – AviD Dec 9 '14 at 12:38

You are proposing doing it backwards. It doesn't do you any good to hold a private key on the server and hand out a public certificate to be used to validate the client. Instead, you want the client to make a key pair and submit the certificate to the server to be stored. The server can then use the certificate to generate a challenge for the client to prove they hold the private key for that client.

Don't invent your own security, it will not be secure. The system you propose is broken and insecure as you described it as the public key is not designed for proof of identity, nor is simply sending the thumbprint a way to validate it.

| improve this answer | |
  • Thanks for the response. I will try it out and then post the updates here. – Saravanan Dec 9 '14 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.