0

I have been asked to connect to a government agency secure site that uses client certificates to authenticate its clients. I received by email an encrypted client certificate as a PKCS#12 file and by other means the password for the file.

The interesting fact is that the PKCS12 file also contains a root certificate authority for that government agency ; when you install the certificate in Firefox, it will also trust the associated root CA. When you install on Windows it will prompt for install and trust the associated root CA.

The government site uses TLS with a certificate generated by that particular root CA, so I think this is the reason why it was bundled in the first place.

But.. from the client point of view, trusting this new root CA is a real security issue.

I guess this site could have been created in a different manner that would not involve planting a new root CA in its clients (i.e. Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA)

Is this government agency trying to be malicious with its root CA, or is it just a cost-effective, acceptable solution ?

nb: There is good documentation for TLS around the web, but not about client certificates deployment. I could not easily find good documented best practices for deploying such a "platform" using client certificate authentication.

Improve this question
2

1 Answer 1

Reset to default
2

Most likely the p12 contents are determined by the tool used to create them. Government agencies are almost legendary in their odd choices of tools and software. It's quite unlikely that anyone involved has thought this through as thoroughly as you have.

Improve this answer
2
  • So, you mean this is an odd choice ? Not exactly a good thing ?
    – JB.
    Mar 9, 2015 at 8:17
  • I mean it's a default choice and no intent should be read in to it.
    – tylerl
    Mar 9, 2015 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .