4 ms·
It really doesn’t make sense to have the client cert be issued by a publicly trusted CA. What’s the assertion being made with that client cert?
by aaomidi 1y ago
It really doesn’t make sense to have the client cert be issued by a publicly trusted CA.
What’s the assertion being made with that client cert?
- greatgib 1y agoIf you can connect to "node1.mydomain.com" and your web browser believe that the server is legitimate because of the CA signature, why a server that would receive a request from "node1.mydomain.com" as certified by the CA signature of the client certificate would worth less than the other one? For a simple example, let's suppose that you would want to use "client certificate" who can access webhooks API that will be pushed to your server.
- aaomidi 1y agoI guess that’s one context where it makes sense. The reason I have difficulty with public CA provided certificates for client certs is that client certs aren’t primarily being used as authentication of a specific user (and maybe authorization). While in servers, certs are practically only being used for authenticating a connection to an endpoint. The issue here being that delegating client cert auth to a third party (Public CAs) means that you’re pushing the problem of monitoring the CA ecosystem to that client. A client that is limited and restricted by the rules of public CAs. But I guess this isn’t that different from OAUTH with a third party IdP.