My general question: Can a two-way SSL connection be forwarded to a 3rd server?

The specifics: I have a WebLogic server supporting two way-SSL, client side's cert is from their CAC card. The weblogic server acts as a gateway to an Oracle Database. Oracle can authenticate the user via Username/password or, preferably, by SSL. Is there a way the weblogic server with an established SSL connection can re-use the client's cert to connect to the db? Assume control over all machines (Database server, Weblogic Server, and Client PC via Java applet).

  • 1
    The general question looks appropriate to security, the specific question may be more appropriate to web applications/programmers/stackoverflow. – user1361991 Jul 31 '15 at 13:54

Is there a way the weblogic server with an established SSL connection can re-use the client's cert to connect to the db?

No, there is no SSL equivalent to SSH Agent Forwarding; the SSL server cannot forward the client certificate credentials to another server.

Now, that's not to say you can't leverage the credentials. If your weblogic server validates the client certificate, and then inserts an "X-I-Authenticated-The-Client: username" header, the backend DB can then treat that as an authentication if, as you say, you have control over and trust between the weblogic and the database layer.

(That's harder if you're not using something like HTTP, but even database connections can do it; consider PostgreSQL 'Trust' or 'Ident' authentication methods.)

| improve this answer | |

SSL certificates can't be used by a third party. Connections rely on each party using a certificate with their own name on it.

Consider implementing a Single-Sign On solution which will allow the user to authenticate once and seamlessly connect to each server.

| improve this answer | |
  • The cert in question is the client cert. – schroeder Jul 31 '15 at 14:40
  • Yes, but the webLogic server can't use it to connect on behalf of the client. – ztk Jul 31 '15 at 14:50
  • 1
    I'm finding your Answer confusing, I think because you leave out some details. Can you flesh out your Answer a little more? – schroeder Jul 31 '15 at 14:56
  • Not necessarily true that each party uses a cert with their own name on it. Given control over all machines, the db and the weblogic server can use the same SSL cert for their side. – user1361991 Jul 31 '15 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.