Questions tagged [mutual]

48 questions
24
votes
1 answer

How do "Confidence images" on my bank's login page improve security?

My bank recently changed their login process to show a preselected image which they label a "Confidence image" - ostensibly to allow a human website user to authenticate the bank's website as not being a spoof. The old login process was: Visit…
Dai
  • 1,728
  • 1
  • 15
  • 20
6
votes
3 answers

haproxy with client certificate authentication signed by 'common' CA

Excuse me if I posted this here wrongly, I know the question is partly about haproxy itself. I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over the internet to a customer. The plan was to use…
Sartsj
  • 101
  • 1
  • 5
6
votes
1 answer

Does HTTP/3 necessitate additional - beyond HTTP/2 via TLS1.3 - restrictions on client authentication (mTLS)?

A recent Nginx release allows me to set listen 443 quic; to enable HTTP/3. Neat. I had been using HTTP/2 with TLS1.3 before, so I did not expect that change much, just optimize round trips with otherwise matching security properties . One major…
anx
  • 400
  • 1
  • 8
6
votes
1 answer

Trust in mutual TLS on chain of certificates in multi-intermediate-CA configuration

Could you please help me to understand whether a client's certificate will be accepted by a server as valid during mutual TLS challenge based on diagram below? The client side knows nothing about server's Intermediate CA B, and vice versa a server…
Viacheslav
  • 163
  • 1
  • 3
5
votes
3 answers

Which external vulnerabilities remain for a web server secured with mTLS?

Scenario: A web server with a web app for remote staff. The web server is behind a reverse proxy (traefik) The web server has a host based firewall configured to allow connections only from the proxy on the designated port. Those connections use…
IamNaN
  • 802
  • 2
  • 10
  • 18
4
votes
2 answers

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. The server verifies that the client presented a…
JZeolla
  • 3,056
  • 2
  • 23
  • 26
4
votes
4 answers

Can mutual TLS work with a self-signed client certificate?

Is it conceptually possible to allow in the server a specific self signed client certificate for mutual TLS? If possible but not recommended. Why? I have a client to who I have to provide a server that does mutual TLS auth. But they say they wont…
David Hofmann
  • 165
  • 1
  • 7
4
votes
1 answer

How can you test Mutual Auth connections?

We're trying to migrate our system from a private data center to a public one (AWS). There are other systems we have no control over that communicate with the one in the private data center. They communicate to us using Mutual Authentication. We…
Daniel Kaplan
  • 143
  • 5
3
votes
1 answer

Mutual authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the aforementioned CA. Server has its own certificate and a private key. While client's certificate…
Maxim V. Pavlov
  • 231
  • 2
  • 7
3
votes
2 answers

Setting up mutual TLS with a shared certificate

If i have a cluster where all the nodes share a single certificate and private key does it count as mutual TLS? Technically both parties in the communication have a certificate and present it to each other.
Sechkin Cholak
  • 31
  • 1
3
votes
1 answer

client_id vs distinguished name in mutual tls

i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS Method that the distinguished name of the client…
loutsi1
  • 71
  • 1
  • 10
3
votes
1 answer

Does the CA have to be same for mutual authentication?

I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall. The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate). The certificate chain in the ServerHello block is from…
Hrishikesh -Rishi- Choudhari
  • 133
  • 1
  • 5
3
votes
3 answers

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully authenticate the server's identity also relying on the FQDN…
Ottootto
  • 133
  • 1
  • 8
2
votes
1 answer

Pre-Requisites for Mutual Authentication

For Mutual Authentication, the client must contain the CA certificate of the Server and his own Certificates, and the server must contain the CA certificate of the Client and his own Certificates.In this way , the Server may contain multiple…
Smrithi
  • 21
  • 1
2
votes
1 answer

Advantage Mutual authentication over PSK

I have a client - server setup with TLS communication. I want to be sure of mutual authentication. The safety that certificates can offer assumes that the private key that links to the certificate remains private. But isn't this the same as assuming…
mstrdenz188
  • 23
  • 1
  • 3
1
2 3 4