Skip to main content

Questions tagged [mutual]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
3 answers
659 views

Using HTTP header to transmit client certificate for mTLS

My client says their API traffic must take the path WAF -> Custom Firewall -> Backend API. Also, mTLS must be terminated after the traffic has gone through the network appliance. I have created ...
chriaass's user avatar
  • 101
5 votes
1 answer
434 views

Does HTTP/3 necessitate additional - beyond HTTP/2 via TLS1.3 - restrictions on client authentication (mTLS)?

A recent Nginx release allows me to set listen 443 quic; to enable HTTP/3. Neat. I had been using HTTP/2 with TLS1.3 before, so I did not expect that change much, just optimize round trips with ...
anx's user avatar
  • 370
1 vote
0 answers
351 views

Client certificate validation [duplicate]

In a mutual TLS connection, both the client and server authenticate each other using digital certificates. However, when the client presents a certificate, the server only sees the client's IP address ...
Mr.Eddart's user avatar
  • 1,003
1 vote
1 answer
205 views

Using certificate-constrained access tokens created by private key used to authentication (with private_key_jwt)

I have a OIDC provider that can't use mutual TLS authentication due to mTLS problems like certificates expiration (what if client didn't rotate certificate and it's expired now? Client cant ...
Szyszka947's user avatar
2 votes
2 answers
1k views

Mutual TLS replacement

When last time I was thinking about mTLS, I came to a conclusion that this is too hard to implement but at the same time it provides high security. The reason why it's hard to implement is that it's ...
Szyszka947's user avatar
1 vote
0 answers
184 views

mTLS on webhooks

I'm not understanding how does Sendgrid verify that's it's me who's sending them the HTTPS request on their webhook endpoint. Specifically, in their docs they show how to obtain their public key (to ...
Jenia Be Nice Please's user avatar
0 votes
2 answers
304 views

Does send HTTP requests as signed tokens make sense when mutual TLS is used?

When we use mTLS, then client and server are authenticated. In this scenario, does it make any sense to send HTTP requests in signed tokens (like JWS)?
Szyszka947's user avatar
0 votes
0 answers
77 views

Is there a need for mutual Authentication in the following use case? if so why?

I came across this use case where mobile devices operating in a pull architecture (connecting to an AWS cloud service endpoint) based on some device triggers will request to be unlocked via a TLS ...
Dave Jones's user avatar
1 vote
1 answer
803 views

HAProxy Trust only specific client certs for mutual

I am using HAProxy to perform Mutual TLS termination for my API. HAProxy has Mutual TLS enabled with "verify required" and a cert-auth file to restrict access to the Apache service that ...
ProfessorQuirrellsEarSweat's user avatar
0 votes
0 answers
211 views

Mutual TLS on OpenSSL - When does the server generate the CertificateVerify message?

When I am testing mutual TLS handshake performance on TLS1.3 using OpenSSL, I find a very wired thing: I created two groups of servers and clients: Server1 has a certificate signed using RSA3072, and ...
JIQING CHEN's user avatar
1 vote
1 answer
1k views

Adding a self-signed client certificate to HAProxy for mutual-tls?

I added the client cert into ca.pem as in bind 0.0.0.0:443 ssl crt /etc/ssl/private/asdf.hdavid.io.pem verify optional ca-file /etc/ssl/certs/ca.pem http-request set-header X-SSL-Client-Verify %...
David Hofmann's user avatar
3 votes
4 answers
3k views

Can mutual TLS work with a self-signed client certificate?

Is it conceptually possible to allow in the server a specific self signed client certificate for mutual TLS? If possible but not recommended. Why? I have a client to who I have to provide a server ...
David Hofmann's user avatar
1 vote
0 answers
753 views

Basic authentication after mTLS?

I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
Errol Neal's user avatar
1 vote
3 answers
5k views

Mutual TLS - with self-signed client certs - what is the security purpose of a client private key in addition to client cert?

In mutual TLS, during client-authentication phase, a client proves its identity to the server by sending its client certificate (Certificate message). Additionally, it signs all previous handshake ...
Borka's user avatar
  • 111
2 votes
1 answer
1k views

client_id vs distinguished name in mutual tls

i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
loutsi1's user avatar
  • 51
1 vote
0 answers
462 views

Difference between JSON web token, bearer token, and MAC token in OAuth2

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format { "iss&...
loutsi1's user avatar
  • 51
0 votes
1 answer
428 views

symmetric keys during mutual TLS

I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server. Between the client and the server, a handshake is utilized in order the two ...
loutsi1's user avatar
  • 51
1 vote
1 answer
950 views

Client — CertificateVerify during handshake

I am trying to understand how the client is authenticated to the server during mutual tls So during the handshake, the client sends this message Client — CertificateVerify This message is used by the ...
loutsi1's user avatar
  • 51
0 votes
1 answer
908 views

What is an endpoint in the context of TLS?

What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access ...
loutsi1's user avatar
  • 51
1 vote
0 answers
817 views

SSH certificates and mutual authentication

SSH certificates are a recent addition to the protocol, and I see them as being used mostly for the clients. Can the server use an SSH certificate too? And if so, is it possible to have mutual SSH ...
SquareRootOfTwentyThree's user avatar
0 votes
1 answer
170 views

How to implement TLS in a product with complex distributed architecture?

We have a distributed product where one server acts as a 'Scheduler' of jobs and there are hundreds if not thousands of 'Agents' which receive commands from the 'Scheduler' and execute the jobs. The ...
Ragavan P's user avatar
1 vote
2 answers
621 views

What is the benefit of public Certificate Authority when using SSL mutual authentication?

I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct. In terms of SSL Mutual Authentication a self signed CA and a public CA ...
JaguaR's user avatar
  • 13
1 vote
1 answer
1k views

Mutual TLS authentication (mTLS) – what can happen if the clients Certification Authority (CA) gets compromised?

I would like to establish a secure connection between two servers (Alice and Bob) via Mutual TLS authentication. That means: Alice provides Bob a certificate signed by CA Bob provides Alice a self-...
Stefan Diabo's user avatar
3 votes
1 answer
3k views

Does the CA have to be same for mutual authentication?

I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall. The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate). The ...
Hrishikesh -Rishi- Choudhari's user avatar
2 votes
4 answers
3k views

Differentiating server and client in Mutual TLS authentication

When authenticating the client side with a certificate that is also verified by our self-signed ca certificate that verifies server certificate, I think It's possible for clients to perform a MITM ...
shark's user avatar
  • 23
1 vote
0 answers
128 views

Is it more secure to mutual authenticate in a single protocol? [closed]

I would like to know if, in a communication between two peer users A and B with no central authority, it is more secure to mutual authenticate both A to B and B to A applying a single protocol, rather ...
user402843's user avatar
6 votes
1 answer
6k views

Trust in mutual TLS on chain of certificates in multi-intermediate-CA configuration

Could you please help me to understand whether a client's certificate will be accepted by a server as valid during mutual TLS challenge based on diagram below? The client side knows nothing about ...
Viacheslav's user avatar
-4 votes
1 answer
529 views

Mutual Authentication [closed]

What are the different types of mutual authentication with some included examples, please? What is the risk of not having it? Regards, Vinay
Vinay Thivari's user avatar
1 vote
0 answers
2k views

Mutual SSL - multiple clients

My question: Is there any reason not to allow multiple clients with their own client certificate (i.e., not using any shared cert) access the same SSL endpoint in the mutual SSL scenario? (I.e., ...
Sasha K's user avatar
  • 67
1 vote
0 answers
151 views

Mutual auth client certs for a pool of requesting servers behind a proxy

I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our ...
Matt Foerschler's user avatar
1 vote
1 answer
181 views

Vendor Mutual SSL required on behalf of different organisations

I'm a software designer (former IT SysAdmin) trying to wrap my head around some authentication requirements in an API Specification document. Let's say government department (abc.gov) has created a ...
Ryan_R's user avatar
  • 11
2 votes
2 answers
634 views

Mutual SSL (CCA) with TLS 1.x: how is appropriate certificate selected by the client and does it send chain or single certificate?

We have an interesting discussion between the server operator team and the developers of a client application. Our setup in general is like this: There is a root-ca, let's call it "root-1". This has ...
Rambler's user avatar
  • 21
2 votes
1 answer
502 views

Win2012R2 TLS1.2 Mutual authentication - change cipher specs from server side after no certificate from client?

I am testing a .net based application running on a Win2012r2 server providing a http-based web services and relying on windows's SChannel for implementing tls1.2 mutual authentication against tls1.2 ...
Ottootto's user avatar
  • 133
4 votes
1 answer
2k views

How can you test Mutual Auth connections?

We're trying to migrate our system from a private data center to a public one (AWS). There are other systems we have no control over that communicate with the one in the private data center. They ...
Daniel Kaplan's user avatar
24 votes
1 answer
6k views

How do "Confidence images" on my bank's login page improve security?

My bank recently changed their login process to show a preselected image which they label a "Confidence image" - ostensibly to allow a human website user to authenticate the bank's website as not ...
Dai's user avatar
  • 1,728
3 votes
3 answers
6k views

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully ...
Ottootto's user avatar
  • 133
1 vote
0 answers
399 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication (2-...
bodell's user avatar
  • 11
2 votes
1 answer
2k views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
Ottootto's user avatar
  • 133
3 votes
1 answer
2k views

Mutual authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the aforementioned CA. Server has its own ...
Maxim V. Pavlov's user avatar
0 votes
1 answer
3k views

Can I use a CA certificate for two ways (mutual) authentication

I cannot get an answer from a CA company for this question. I have to implement two ways SSL authentication between my server and my users computers. Users should access to my several API securly. I ...
efkan's user avatar
  • 352
1 vote
1 answer
743 views

Pre-Requisites for Mutual Authentication

For Mutual Authentication, the client must contain the CA certificate of the Server and his own Certificates, and the server must contain the CA certificate of the Client and his own Certificates.In ...
Smrithi's user avatar
  • 11
6 votes
3 answers
7k views

haproxy with client certificate authentication signed by 'common' CA

Excuse me if I posted this here wrongly, I know the question is partly about haproxy itself. I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over ...
Sartsj's user avatar
  • 101
1 vote
3 answers
407 views

HTTP authentication: identify the client

We have a web-site, where each user has to log-in to access a private area. Inside the private area, there are some information about the user, a profile, including some sensitive information (home ...
Lorenzo Dematté's user avatar
1 vote
1 answer
3k views

Advantage Mutual authentication over PSK [duplicate]

I have a client - server setup with TLS communication. I want to be sure of mutual authentication. The safety that certificates can offer assumes that the private key that links to the certificate ...
mstrdenz188's user avatar
1 vote
1 answer
729 views

What is the purpose of Rb in the 3rd step of the 3-pass mutual authentication in ISO/IES 9798-2?

Recently I am studying ISO 9798-2 Three-pass mutual authentication. There are 3 steps, as following: B -> A: NB // B sends to A a "nonce" value NB A -> B: {NB||NA}K // A's identity is proven to ...
will1978's user avatar
4 votes
2 answers
1k views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
JZeolla's user avatar
  • 3,016