0

I want to make sure that my webapp is secured:

I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed).

On the client - installed a certificate issued by the CA.

As I was warned in a previous question I made , I want to make sure that:

  1. The tomcat server - gets the client's certificate - makes sure it is signed by the CA, and then - authenticates the client by using the public key in the client's certificate - to make sure that the client can really decrypt the data.

and not:

  1. The tomcat server - gets the client's certificate - makes sure it is signed by the CA and then start communication without verifying that the sender of the certificate is really the owner of the private keys associated with it

So - is option 1 or 2 is true?

Thanks

  • 2
    Sorry to be a pain, but can you re-phrase to make it more clear what the question is? Currently it just looks like 2 statements without a question. – Mike Ounsworth May 5 '15 at 17:18
1

As part of the handshake for mutual auth SSL, both the server and the client have to prove that they hold the private key corresponding to their cert. If that isn't the case, the SSL handshake will fail. I think that is option (1) of your question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.