Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [mutual]

The tag has no usage guidance.

2
votes
1answer
75 views

Does the CA have to be same for mutual authentication?

I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall. The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate). The ...
0
votes
3answers
147 views

Differentiating server and client in Mutual TLS authentication

When authenticating the client side with a certificate that is also verified by our self-signed ca certificate that verifies server certificate, I think It's possible for clients to perform a MITM ...
1
vote
0answers
52 views

Is it more secure to mutual authenticate in a single protocol? [closed]

I would like to know if, in a communication between two peer users A and B with no central authority, it is more secure to mutual authenticate both A to B and B to A applying a single protocol, rather ...
1
vote
1answer
421 views

Trust in mutual TLS on chain of certificates in multi-intermediate-CA configuration

Could you please help me to understand whether a client's certificate will be accepted by a server as valid during mutual TLS challenge based on diagram below? The client side knows nothing about ...
-4
votes
1answer
65 views

Mutual Authentication [closed]

What are the different types of mutual authentication with some included examples, please? What is the risk of not having it? Regards, Vinay
1
vote
0answers
428 views

Mutual SSL - multiple clients

My question: Is there any reason not to allow multiple clients with their own client certificate (i.e., not using any shared cert) access the same SSL endpoint in the mutual SSL scenario? (I.e., ...
1
vote
0answers
48 views

Mutual auth client certs for a pool of requesting servers behind a proxy

I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our ...
1
vote
1answer
80 views

Vendor Mutual SSL required on behalf of different organisations

I'm a software designer (former IT SysAdmin) trying to wrap my head around some authentication requirements in an API Specification document. Let's say government department (abc.gov) has created a ...
0
votes
0answers
56 views

TLS Mutual Authentication to Unlock Two Devices

I am relatively new to TLS and certificate based authentication but I get the general idea. Pardon me if I am posting in the wrong place. Basically I want to use a TLS handshake over LAN to unlock ...
1
vote
1answer
248 views

Mutual SSL (CCA) with TLS 1.x: how is appropriate certificate selected by the client and does it send chain or single certificate?

We have an interesting discussion between the server operator team and the developers of a client application. Our setup in general is like this: There is a root-ca, let's call it "root-1". This has ...
2
votes
1answer
279 views

Win2012R2 TLS1.2 Mutual authentication - change cipher specs from server side after no certificate from client?

I am testing a .net based application running on a Win2012r2 server providing a http-based web services and relying on windows's SChannel for implementing tls1.2 mutual authentication against tls1.2 ...
4
votes
1answer
827 views

How can you test Mutual Auth connections?

We're trying to migrate our system from a private data center to a public one (AWS). There are other systems we have no control over that communicate with the one in the private data center. They ...
22
votes
1answer
4k views

How do “Confidence images” on my bank's login page improve security?

My bank recently changed their login process to show a preselected image which they label a "Confidence image" - ostensibly to allow a human website user to authenticate the bank's website as not ...
2
votes
3answers
2k views

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully ...
1
vote
0answers
132 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication (2-...
2
votes
1answer
1k views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
2
votes
1answer
673 views

Mutual authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the aforementioned CA. Server has its own ...
0
votes
1answer
2k views

Can I use a CA certificate for two ways (mutual) authentication

I cannot get an answer from a CA company for this question. I have to implement two ways SSL authentication between my server and my users computers. Users should access to my several API securly. I ...
1
vote
1answer
407 views

Pre-Requisites for Mutual Authentication

For Mutual Authentication, the client must contain the CA certificate of the Server and his own Certificates, and the server must contain the CA certificate of the Client and his own Certificates.In ...
6
votes
3answers
5k views

haproxy with client certificate authentication signed by 'common' CA

Excuse me if I posted this here wrongly, I know the question is partly about haproxy itself. I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over ...
1
vote
3answers
321 views

HTTP authentication: identify the client

We have a web-site, where each user has to log-in to access a private area. Inside the private area, there are some information about the user, a profile, including some sensitive information (home ...
0
votes
1answer
2k views

Advantage Mutual authentication over PSK [duplicate]

I have a client - server setup with TLS communication. I want to be sure of mutual authentication. The safety that certificates can offer assumes that the private key that links to the certificate ...
1
vote
1answer
557 views

What is the purpose of Rb in the 3rd step of the 3-pass mutual authentication in ISO/IES 9798-2?

Recently I am studying ISO 9798-2 Three-pass mutual authentication. There are 3 steps, as following: B -> A: NB // B sends to A a "nonce" value NB A -> B: {NB||NA}K // A's identity is proven to ...
4
votes
2answers
689 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...