CODEWITHSUNDEEP
sslencryption
Balazs Varhegyi
Balazs Varhegyi

Reputation: 1041

Is SSL with server certificate and client password possible?

Based on this answer: https://stackoverflow.com/a/3107645/1559672 it's possible to set up ssl connection without user verification.

I think the answer to my question would be yes but can't find anything to confirm/reject it.

The idea is that the server has a certificate that the client can verify via a CA. Then client generates some secret and encrypts with server's public key. Based on this shared secret they generate 'key material' for encryption/decryption. After they have the secured connection, client can verify itself with username/password.

Is it possible like this? if yes, please show me some example or proof. If not, why not?

Upvotes: 0

Views: 1406

Answers (1)

deceze
deceze

Reputation: 522510

The reason of confusion was because of RabbitMQ doc: rabbitmq.com/ssl.html "Connecting without validating certificates" 's example code doesnt define what server certificates or RootCAs are accepted. (RabbitMQ cert is self signed) So I don't get how TLS is set up without that?

Encryption does not depend on certificates. And a self-signed certificate is still a valid certificate.

The purpose of certificates is to prove the identity of the remote peer. Can you really be sure you're talking to the server you think you're talking to and that your connection isn't currently being hijacked? This is ensured by the server presenting a certificate only it could have (public/private key crypto validates this, only the server should have the private key for the certificate; trust/security here depends on the server keeping its private key to itself).

How do you trust the certificate? Well, you may have a copy of it in your trusted certificate store. You'd do this with a self-signed certificate: just put it in your trusted store; since you (presumably) know where it came from, it's trustworthy.
Since this is unrealistic for every public site on the web, a public key infrastructure exists which allows you to trust a limited known number of certificate authorities which can sign certificates of arbitrary unknown parties, and you can indirectly trust those heretofore unknown certificates.

Having said all this, encryption is a separate component and an encrypted, secured connection can be set up with or without the identity verification that certificates provide.

Upvotes: 1

Related Questions