3

I've been developing a web application and APIs for 8 months. I implemented OAuth 2.0 client credentials for authentication. And now I have to implement TLS to my APIs. I've been dealing with SSL/TLS security implementations for days. I couldn't anything. Still, I'm at the start and started to feel the despair.

I can be wrong, but I thought, I can issue certificates on my web page to my users. And users can use those when they are trying to use my API for SSL-Client Authentication. (like Paypal) There are a lot of things that are must known. So I need help.

Q: I'd like to know is there any missing item on my list ? What else should I do ?
Q: Would it be possible there is an alternate way to provide secure for my API ?

        Summary of my to-do list;

  1. Create a CA key and cert using OpenSSL
  2. Create server key and cert using OpenSSL
  3. Put a "new cert." button on my web page and code
    If a user clicks the button then;

    a. generate a downloadable client certificate using PKIjs-x509

    b. a copy of the certificate is saved on a clients folder on the server

  4. Create and manage a Certificate Revocation List to CA using using PKIjs-CRL

  5. Put a "remove cert." button on the web page and code
    If a user clicks the button then;

    a. add related certificate to CRL

  6. If a user leave from system then add related certificate to CRL

I think number 4, 5 and 6 (CRL operations) are redundant. I need a secure connection between client and server. Every different client certificate creates a different secure channel to the server. So, if a malicious man uses a certificate he can access only my authorization server, securely. Therefore these items seem not important in my case. Are they?

I use Node.js and javascript. I found some useful javascript libraries like PKIjs, forge.js and pem .

I've given a call to one of the global CA companies for their PKI service. They gave me $30 per client and I cannot use their CRL as programmaticaly on my application. This is impossible for me. So I've been trying to solve by myself.

Keywords to remember some things;
( EJBCA, x.509, PKI, Key-Exchange, S/MIME, OpenSSL, RSA, ASN.1, PCKS, Fingerprint )

  • Are you sure you need client certificates? You already have OAuth – Neil McGuigan Apr 14 '15 at 18:40
  • Unfortunately yes. Because I've implemented client credential authentication.A client make a request for an access token to my authorization server using HTTP-Basic Authentication method that is included client_id and client_secret as username and password. And this communication should be occured in a secure channel. The specification indicates as TLS in many places. e.g. Section 2.3.1 Client Passowrd The authorization server MUST require the use of TLS as described in Section 1.6 when sending requests using password authentication. tools.ietf.org/html/rfc6749#section-2.3.1 – efkan Apr 15 '15 at 6:54
  • at the same time I guess, someone can read a user's data-packages and take access_token. So developers who use OAuth 2.0 must use TLS at every single time. – efkan Apr 15 '15 at 7:58
  • I'm going to second Neil here. This sounds like you need a confidential channel to the server. And regular server-auth-but-no-client-auth type TLS will do that nicely. If you have a different method of authenticating the client, then you don't need to use TLS's way of doing this. (And I also don't see how the RFC mandates client side certs.) – StackzOfZtuff Apr 15 '15 at 12:35
  • I need every idea. Actually you're right. However, I think OAuth 2.0 might provide me some advantages on my mobile app in the future. And yes, RFC doesn't say that how to use TLS on auth operation, one-way or two-way (mutual). I'd really like to know if there is an alternate way you know :) – efkan Apr 15 '15 at 12:49
1

I found a solution as I was looking for;

http://blog.engelke.com/2015/03/03/creating-x-509-certificates-with-web-crypto-and-pkijs/

But I'll try pem modulus at first. Because it works on back-end and seems more simple.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.