0

I have web server (hosted using IIS) in DMZ hosts multiple web services (WCF), the clients are non-server applications (they are standalone .NET application) reaching these web services via internet using the HTTPS protocol.

My server has an SSL certificate issued by Verisign, the point is that my client does not have any type of credential and any machine with that application (or similar app) should be able to consume the services. The information passing between client machine and server must be encrypted and signed.

So this is my question: is having the certificate and using the transport security enough to make sure that nobody can read the messages passing between client and server? Or do I have to somehow come up with some kind of ad hoc client credential and add message security?
This link describes that SSL is good for Intranet and for internet message security is suggested why? What happens if I only use SSL and no message security for the internet scenario?

Improve this question

1 Answer 1

Reset to default
0

is having the certificate and using the transport security enough to make sure that nobody can read the messages passing between client and server?

For all intents and purposes, yes. (barring MitM attacks)

Or do I have to somehow come up with some kind of ad hoc client credential and add message security?

Negative.

This link describes that SSL is good for Intranet and for internet message security is suggested why?

Because during an intranet deployment you maintain control of all systems on a private network and can ensure that each system is indeed using transport security when sending data over the LAN/WAN.

Message security is preferred when using an "internet" scenario because you will be interacting with 3rd parties. You may not be able to ensure that these 3rd parties haven't been compromised and/or are enforcing transport security along the entire chain.

What happens if I only use SSL and no message security for the internet scenario?

I'm a little fuzzy on your infrastructure configuration and which parts of it you actually own versus which parts are being rented from a hosting provider, but per Microsoft's recommendations Message Security is the preferred method when messages may be routed through intermediate systems. (aka: the internet)

Improve this answer
1
  • Thanks! I had asked this question in some other communities and so far this one was the best. Indeed I almost have all controls over the infrastructure, the host is a server managed by internal IT team, though clients are connecting to it through internet and I cannot enforce users to create any kind of credential.
    – Fred Jand
    Commented May 14, 2015 at 1:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .