Ssl – Mutual SSL authentication – client certificate vs server certificate

certificateiisSecuritysslssl-certificate

I am setting up a web application which will connect to a remote web service and is required to use a client certificate. My web app uses HTTPS to connect and I have it configured with my existing wildcard certificate for my domain.

Can I use my public key from the wildcard certificate as my client certificate? I'll need to provide it to the remote web service admins so they can add it to the list of trusted client certificates.

Is there any disadvantage to using my wildcard's public key as my client certificate? If I can't/shouldn't do it this way, what kind of certificate can I use instead?

Best Answer

One disadvantage is that your private key may now be on two machines.

A client key should be private, by definition. If it's shared, then it's not private.

That instantly reduces the trust anyone can have in your certificate. All other users of that server (if there are any) cannot now trust it, as its private key is known to be shared.

Your question doesn't state whether you're using your own CA or a commercial CA. If it's commercial, you maybe breaking the CA's terms & conditions by sharing the private key.

Best would be to simply create another certificate for your client. If you're running your own CA, simply create another certificate. If it's commercial, either purchase a new certificate for your client or get a free one. Either way, if your certificate will have an Extended Key Usage field, make sure it contains 'Client Authentication' (instead of 'Server Authentication').

As you clarified, your setup is one machine acting as a client and a server. In this situation you need to be aware of the slight difference in the certificate profiles for server authentication and client authentication:

A server certificate will have the DNS name of the server as either it CommonName (CN) or Subject Alternate Name (SAN), or both. A client certificate will usually have your email address as a CN, although there is no reason it can't be anything else.

The Extended Key Usage extension for a server certificate should be server authentication, while for a client certificate it should be client authentication. This may cause issues.

Related Topic