2

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key pair to encrypt requests & responses.

If someone find this public key (it comes with client software) and reverse-engineer the software I think they can send handmade requests with a custom id. I want to prevent this kind of attacks. I have couple of questions:

  • Is generating private-public key pair for each client is a good practice? Since every client sends it's requests with their own public key, it will be easy to detect this kind of anomalies.
  • Is it possible to give clients certificates that identifies only them? I see this client certificate thing everywhere but there is no clear explanation. Can you guys explain me how client certificates works? I think this is what I need but I have no idea about it.
Improve this question
2
  • What exactly do you want to know about client certificates with HTTPS? – Philipp Feb 24 '15 at 16:38
  • I want to know how can I identitiy each client and before them sending requests to server how can I be sure the client that I created IS sending the request and its not violated. – Batuhan Feb 24 '15 at 17:20
1

If you want to authenticate a client to your server, you will need a private key for each client.

The usual HTTPS method (TLS) uses only one certificate to authenticate a server. The server has his public key published and signed by some authority, the client verifies the certificate and the authority signature of the certificate, then the client is sure to communicate with the right server, since only this server can sign the communication with his own (corresponding) private key.

Usual HTTPS method only authenticate the server.

If you want the client to be authenticated as well, they need their own private/public key-pair. After having authenticated the server, the client will send their public key and the server can then check the certificate against a local database, or a more global infrastructure if the certificates (of the clients) are signed by an authority.

Other parts of the HTTPS protocol support client authentication in this way.

Improve this answer
3
  • This is incorrect - HTTPS also allows to authenticate the client with a certificate. – Philipp Feb 24 '15 at 16:28
  • I know this. That's why I said "standard" https method, as in the most used when talking about https connections with websites. Edited for clarity. – M'vy Feb 24 '15 at 16:30
  • What "standard" are you talking about, if not RFC 5246 (TLS Version 1.2) which defines how client certificates work in TLS? And yes, all major web browsers support this. Yes, it isn't used frequently, but it is definitely a "standard". – Philipp Feb 24 '15 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.