RE: Storing Client Certificates

From: Todd Bright (ToddBright_at_discussions.microsoft.com)
Date: 03/24/05 

Date: Thu, 24 Mar 2005 09:07:02 -0800

Maybe I should back up here. From what I've read, the client-side cert is
generated based on the server-side cert and is used for authentication to
access the web site on the IIS server.

We are going to have several hundred (or thousand) clients accessing our
servers. As an extra security measure we are going to use client-side certs
in order to validate that a client accessing a web server is actually one of
our installed clients and not just someone coming in thru a browser who
"happened" upon the URL.

I've tested this and if you tell your web site in IIS to require client
certificates and the client doesn't have the appropriate client certificate
the server will return an error page. Now, if someone hacks into the
client's machine and is able to find the cert file (assuming it's stored on
the HDD in its own file), the hacker will be able to do anything that our
client application is doing (i.e. upload files). He will, in a sense, become
our client application as far as the server is concerned.

Am I way off base here? If so, what is the use of client certificates other
than to authenticate with the server??? If not, my question still stands...
what's a good way to store the client cert on the client machine so noone can
get their hands on it and use it to authenticate themselves with the server?

"Todd Bright" wrote:

> Is there a way in .Net to specify that an embedded resource can only be
> accessed from within the assembly?
>
> Or, in general, what is the best/most secure way of storing a client-side
> cert without having to have a user profile?
>
> Thanks,
> Todd

Relevant Pages

  • Re: What doesnt lend itself to OO?
    ... >> proxy and instructs the server to constuct the real object. ... rather than client code. ... If 'clock' is instantiated in the server, ... > for the server interface at the OOA level. ...
    (comp.object)
  • This is going straight to the pool room
    ... or not the client has privilege to do what they're trying to do, ... The server environment is this: ... 3GL User action Routines that Tier3 will execute on your behalf during the ... Routine Name: USER_INIT ...
    (comp.os.vms)
  • Re: Java GSS/Kerberos issue - Autheticating server
    ... I can authenticate as that particular principal in the client portion of the ... I have a server and a client portion of code that pass GSS-wrapped kerberos ... Client authenticates to kerberos server and logs in, ...
    (comp.protocols.kerberos)
  • [Full-Disclosure] R: Full-Disclosure Digest, Vol 3, Issue 42
    ... Full-Disclosure Digest, Vol 3, Issue 42 ... SD Server 4.0.70 Directory Traversal Bug ... Arkeia Network Backup Client Remote Access ...
    (Full-Disclosure)
  • Re: What doesnt lend itself to OO?
    ... > rather than client code. ... no way to do that without also touching the object with clock semantics ... will not encapsulate both clock semantics and network semantics. ... The server can do whatever it wants ...
    (comp.object)