I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet.
I'm working on an application that communicates with another on a separate network. Each application acts as both a client and a server in bi-directional communication. They will use REST services over HTTPS with each network's firewall opened explicitly for the other. All SSL certificates will be self-signed. My application is written in Java but I'm not sure about the other.
I believe I have two options to establish the HTTPS connections with self-signed certificates:
- Each application's underlying Framework (e.g. Java) installs the other's self-signed certificate, resulting in that framework, and not necessarily the wider OS, trusting the certificate
- Each server installs the other's certificate as a root Certificate Authority and therefore trusts any self-signed certificate produced by the other server. A framework like Java should acknowledge this OS-level root Certificate Authority but a web browser on that server might not as it maintains its own database
The server I'm working on has the following files already generated:
server.key. I believe these are generated using
openssl genrsa. I understand that the
.crt is the public certificate and the
.key is its private key counterpart. My main question is
- Can the
.crtbe treated as either a framework-level certificate or an OS-level root Certificate Authority by the other server (i.e. do I get to choose how I install it)? In my research online this has been very confusing as many of the terms seem overloaded. I can't tell if I'm working with a Certificate Authority or just a regular certificate.
- If the answer to 1 is no, what kind of file do I need to generate from the existing files to install just the self-signed certificate?
Any help much appreciated, and please assume that providing links to Wikipedia pages will not help me much.