CODEWITHSUNDEEP
sslssl-certificateclient-certificates
Golo Roden
Golo Roden

Reputation: 150624

Using a server-side certificate for client-side authentication

Supposed I have a scenario with a web browser and two servers: The first server (web) is internet-facing, the second (worker) is an internal one. Internally web uses worker, but every request from the outside is received by web.

So you always have:

browser -> web -> worker

Now I want to secure both connections using SSL:

In this scenario: Is it okay to re-use the server-side certificate of web as client-side certificate for worker, or is it better to use two individual certificates?

Are there any best practices I should watch out for?

Upvotes: 1

Views: 1322

Answers (1)

Eugene Mayevski 'Callback
Eugene Mayevski 'Callback

Reputation: 46050

There are two aspects here: security aspect and "technical" aspect.

Technical aspect is that the certificate KeyUsage and ExtKeyUsage extensions of the certificate are different for server-side and client-side certificate. Worker will inspect the value of those extensions and complain. This will happen unless you implement custom validator on the worker (in which case any certificate you want will work).

Security aspect is that if the private key leaks for whatever reason, having different certificates (and so private keys) increases security to certain extent.

Upvotes: 2

Related Questions