I seem to have mis-understanding around client auth certs...

If you have software that will use Client Auth certificates over SSL (such as those installed on a remote desktop via Windows Certificate manager), and this has proven to work with self-signed certs....

Where / how do you purchase a 'client auth cert' that would be from a trusted CA vs private?

  • 1
    Client Certificates are most commonly used with a private CA, because they're usually used to authenticate "valid users for organization X" and not "users from anywhere who organization X wants to trust a CA's validation of" – gowenfawr Jan 27 '15 at 19:52
  • Thanks gowenfawr for that feedback - so what is the normal procedure when you have a trusted CA SSL/TLS cert on the server, or are the server certificates unrelated to the client certificates? – dhartford Jan 27 '15 at 20:08
  • There is no relation between the two - the server certificate can be whatever you want, and should be CA-signed to provide reasonable assurance to your visitors that you are who you are. The server is configured to accept client certificates signed by (your chosen CA), and the assurance you have is that you control the process of handing out those certs to just the right people. With client certs the assurance usually lies in controlling the distribution process, not trusting a 3rd party CA to distribute them. – gowenfawr Jan 27 '15 at 20:15

Why do you need the client cert to be signed by a commercial CA?

This is needed for the server side since commercial CA act as a trusted third party for most client application since they have no way to check your public certificate authenticity otherwise.

Most often when using client-side authentication the authority is the organisation owning the server you want to authenticate to, and this is this organisation which will provide or sign you the required client certificates. In other words, if you want to connect to a server owned by company 'A', you need a certificate signed by company 'A' to proceed.

However, for some very specific use cases (some financial transfer protocols for instance) customers can come on board using certificates signed by a trusted third party, but in this case the company you want to connect to will provide you the list of trusted third parties you can choose from (Swift is the most common in this area, but there are a few others).

  • If you are the entity owning the server, and you create a client cert for computers/users outside your network, do you have to also put that creating CA root cert on those (outside your control) computers? (my ignorance is greater than expected, so help me learn please :-) – dhartford Jan 27 '15 at 20:14
  • You can freely distribute the public version of the creating CA root to your client along with their private or signed certs, it depends on the exact client software used but some might indeed require it. At the opposite, the private key associated to the creating CA must remain secret and well protected at all cost. – WhiteWinterWolf Jan 27 '15 at 20:32

The most commonly available SSL certs have a specific field which says it can't be used as CA root/intermediate cert, thus for issuing new certs.

From openssl x509 -in cert.pem -noout -text:

X509v3 Basic Constraints: critical

I believe it is not possible to purchase a publicly trusted CA cert easily, it would broke the whole trust chain model.

Continue to GZBK answer, to see why you don't need it for signing client certs, you can do it with a self-signed CA cert.

  • As soon as I get enough rep, I would upvote this answer for the specific example and additional info around needing new CA (not try to use a commercially acquired SSL Cert) to create the client cert. :-) – dhartford Jan 29 '15 at 14:28

There are a large number of commercial CAs you can buy from. Symantec is the largest but a google search of "buy ssl certificate" will give you a few thousand other options.

  • 1
    You can't use regular SSL certs to issue new certs. See my answer. – zakjan Jan 28 '15 at 3:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.