1

Lets say my company produces a device which can be connected to secure websites or it may act as some kind of server.

Lets say I produced 100 pieces of the same device. Should I get one SSL certificate for all of them or 100 unique certficates? 

Or even better, Can I still communicate with a secure server without a certificate?

I need to know how it is done currently in the industry, for example in the case of mobile phones.

  • Will they all be distributed to the same company, or will they go to different companies? – cpast Apr 21 '15 at 4:49
  • It will be given to different users just like mobile phones are used by many people. You can think of device as a portable device which will be used by people, not organizations – Sreejith M M Apr 21 '15 at 5:23
  • What do you intend to achieve with the certificate? Note: Clients do not need to use a certificate for TLS; there are client certs, but they're generally used within an organization to authenticate with your organizational account, and aren't used for general-purpose TLS. – cpast Apr 21 '15 at 5:38
1

As a rule, each should be unique.

The private key associated with a certificate needs to be secret. If that secret gets out, then they don't offer any protection. You can assume that anyone who has possession of a device can extract the key from that device, so you want each key to be unique.

Certificates needn't be signed to offer protection. It helps, but the encryption still works without the signature. If you have to decide between an unsigned certificate and a compromised key, I think the situation is worse with a compromised key.

As for communicating with a remote server, you only need a certificate for running the server, not for connecting to it.

  • If client does not need a certificate, how , lets say ,Google, will know what public key needs to be used while communicating with my phone during an Https? – Sreejith M M Apr 21 '15 at 7:33
  • It doesn't. A certificate is used to authenticate one side. Typically on the server is authenticated, and any client is allowed to connect. If you want to authenticate a CLIENT using certificates, that's an option, but it's uncommon. – tylerl Apr 21 '15 at 23:01
1

A certificate is used to make sure that you connect to the correct device, that is that no man-in-the-middle is intercepting the connection. If you employ the same certificate on lots of devices which are shipped to lots of different customers the goal of proper verification if your own device can not be reached. Apart from that each of these devices would probably contain the same private key, thus extracting the private key from a single of these devices would make an attacker to intercept communication of all of the others and depending on the ciphers used would also make it be able to decrypt also previously intercepted encrypted traffic.

Thus the usual way is to create a unique certificate for each device, with a unique public and private key. Even better is to let the user replace the certificate with their own, because this way in can be better integrated in their own infrastructure.

  • So, two iPhones(for eg) has different SSL certifcates? In the case of linux laptop or an android phone where can I see the certificate file? – Sreejith M M Apr 21 '15 at 5:21
  • @SreejithMM Certificates are associated with servers, not clients (there is such a thing as a client cert, but that is used by a very, very, very small fraction of users and is never preloaded into a general consumer product). An iPhone doesn't have a certificate pair installed, because it doesn't need one, not being a server. – cpast Apr 21 '15 at 5:35
  • How server will know the public key of my phone? – Sreejith M M Apr 21 '15 at 7:34
  • Your phone does not have a public key unless TLS based client authentication is used (usually not). I think you should study the basics of how TLS works. – Steffen Ullrich Apr 21 '15 at 7:35
  • Ok. I got it. Symmetric key of client will be used for session – Sreejith M M Apr 21 '15 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.