Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: Dominick Baier <dbaier@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Thu, 19 Oct 2006 16:40:30 +0000 (UTC)
SSL, thus message level security adds unnecessary overhead. Is there
a good way to do mutual authentication at first connection to the web
service so there is no signficant overhead for message based security?
thats _exactly_ what SSL is doing.
for client certificate authentication, simply require SSL client certificates in IIS (directory security tab).
Finally, if I do need a client certificate to do the mutual
authentication; how do I generate a client certificate? Can I
You can use a public CA or Windows Certificate Services or makercert.exe
---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com
Dominick said I don't need message level security since I am using
SSL, thus message level security adds unnecessary overhead. Is there
a good way to do mutual authentication at first connection to the web
service so there is no signficant overhead for message based security?
Is there any "how to" or examples on how to implement mutual
authentication, ideally, without requiring message based security?
Finally, if I do need a client certificate to do the mutual
authentication; how do I generate a client certificate? Can I
generate a client certificate from a server SSL certificate (which my
server has) OR do I need another type of certificate on my server.
I know there are several questions here, but please answer each one.
"Steven Cheng[MSFT]" wrote:
Hello John,
If you use WSE message layer security, the "mutualCertificate10" and
"mutualCertificate11" will both support mutual authentication againt
both server and client.
As for transport layer secruity through SSL/HTTPS, as I mentioned in
the last reply, you can add code logic in your webservice client and
hook the Server Certificate validation process to determine whether
the https/SSL server is a valid and expected server.
Sincerely,
Steven Cheng
Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no
rights.
.
- Follow-Ups:
- Prev by Date: RE: Membership - Database Security
- Next by Date: Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Previous by thread: Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Next by thread: Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Index(es):
Relevant Pages
|
