0

As far as I know, in an authenticated SSL connection, both the client and server have private keys and provide their certificates (with the corresponding public keys) across the connection before establishing the secure connection.

However, I'm a bit confused as there is a normal openSSL connectivity with these certificates and keys being used at server and client side but if client key/public key generated by openssl command is created by different CA than server private key then connectivity should not happen but its not happening in the experiment I tried with openSSL.

Is it not un-expected? Is it usual to have different set of keys at client and server side by different CA? Does openSSL generate a key pair on the fly for each session and is not dependent on client? Does anyone has any idea how these keys/certificates work at server and clent side and do these keys and certificates had any kind of relation/dependency between them?

|improve this question
0

There is no requirement for the certification path for the server authentication and the client authentication to be the same one.

All that needs to happen for server authentication is that the server presents a certificate (along with any subordinate/intermediate CA certificates) that chains up to a trust anchor (in practice, a root CA certificate stored in the client trust store) the client trusts. The client now trusts the server.

Similarly, for client authentication the client must present a certificate (along with any subordinate/intermediate CA certificate) that chains up to a trust anchor (again, a root CA certificate) that the server trusts. The server now trusts the client.

The two trust anchors do not have to be the same, they merely have to be trusted by the relevant party.

|improve this answer
  • Thanks garethTheRed for your input. But le me explain more clearly . the server has the certificate and key signed by a CA which it sends to the to the client and the client is having its own CA and certificates and keys signed by it.Hoe can the client be authenticated by server if both are having Key and certificate signed by different CA ? – ANS Jan 27 '16 at 12:30
  • Because they are two completely different actions. An analogy: If I were to meet you in a local park to exchange some important documents, you might bring your passport as evidence of who you are and I might bring my driving licence. As long as I trust the authority that issued you your passport, then I'm happy. Similarly, as long as you trust the authority that issued my driving licence, then you're happy. They are two different authorities (trust anchors) but we're both happy and can exchange documents. We could have used the same trust anchor (both brought passports) but we didn't. – garethTheRed Jan 27 '16 at 14:19
  • By the way, a CA signs the certificate and not the keys. The private key stays on the owner's computer while the public key is embedded in the certificate request along with other fields. It is this certificate request that is signed by a CA to become a certificate. – garethTheRed Jan 27 '16 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.