Re: creating multiple client certificates
- From: David Wang <w3.4you@xxxxxxxxx>
- Date: Mon, 14 Jul 2008 04:09:06 -0700 (PDT)
On Jul 14, 12:55 am, Alastair <Alast...@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:
Hi David,
thanks for your reply. Perhaps I’m getting the wrong idea of certificates.
I’ll try to explain what we want to do, our setup is as follows: firewall
connected to the internet which allows a port (not 443) through to the port
configured as ssl on the iis server. We want to only allow the 10 or so PC’s
and WM6 devices through that we have configured to connect.
This is where we thought that having a client certificate would provide
additional security (by stopping any other pc connecting), i.e. we would
manually install the client cert (only applicable to the iis server) only on
the authorised pc’s/wm6 devices. To gain access to the web application, the
user has to enter a username/password, so the client cert does not have to
authenticate the user onto the active directory.
If we use no client cert at all, are we making the IIS server more
vulnerable to any security problems by opening the firewall port through to
that server?
Thanks again for your help, it is much appreciated!
Alastair.
To me, your usage of Client Certificate does not improve security.
By opening the firewall port, you are allowing SSL traffic to IIS.
Client Certificate does not affect any "security problems" due to such
opening.
Client Certificate is something negotiated on that SSL handshake, but
unless something authorizes based on the certificate, providing it is
useless and does not improve security.
IIS Certificate Mapping only performs an authentication mapping -- no
authorization -- so you will need to provide custom code to perform
your custom authorization scheme to lock down access.
Personally, the username/password should be sufficient lockdown to
those users.
The certificate help lockdown further to only those devices, assuming
you've taken care to not allow those certificates to be copied and
transferred between devices.
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
.
- References:
- Re: creating multiple client certificates
- From: David Wang
- Re: creating multiple client certificates
- Prev by Date: Re: creating multiple client certificates
- Next by Date: Re: creating multiple client certificates
- Previous by thread: Re: creating multiple client certificates
- Next by thread: Re: creating multiple client certificates
- Index(es):
Relevant Pages
|
