1

I have a legacy web application where user are identified and authenticated with client certificates. Now, customer wants to use the same client certificate to authenticate against a newly created web application (different host name). I think this is not possible, since the server certificates have to be different.

Is there a way around that? Is it possible to re-sign a certificate? (I have access to all certificates, server keys and the signing CA and am writing the new application).

1 Answer 1

2

Client certificates are used to authenticate the clients, so they should have nothing to do with your server certificate.

Step 1 Client certificates are signed by a CA. If you tell your web app (your server) to trust that CA, then your server will accept the client certificate. Simple as that. Depending on your setup, this is easy to do. For example, for Apache, you can add the following in httpd.conf:

SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile conf/ssl.crt/ca.crt

Where the 'SSLCaCertificateFile' contains the path to the certificate of the CA which was used to sign the client certificates.

Step 2 Step 2 is then to make sure the client is known (but this should be irrelevant for your question). This is, the certificate is trusted now (step 1), now you have to extract the client name (which is present in the certificate), and make sure this client can be granted access.

1
  • Thanks, I see my basic misunderstanding of the concept :-) In case anybody needs this: I'm using Nginx, so the configuration looks like: ssl_client_certificate ssl/ca.crt;. The headers are forwarded to underlying application server by proxy_set_header X-SSL-User-DN $ssl_client_s_dn;. Commented Jan 13, 2015 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .