Security of Self-Signed Certificate Versus Commercial Certificate in Two-Way SSL Client Certificate Authentication Solution

Products

• STARTER PACK-7
• CA Rapid App Security
• CA API Gateway

Issue/Introduction

We have a two-way SSL solution that does client certificate authentication on a self-signed client certificate coming from the requesting application installed on the CA API Gateway. That certificate is associated with the local Federated Identity Provider (FIP) user and is equivalent from a security standpoint to using a commercially signed certificate, in our view.

What is CA Technologies' standpoint on this? Does CA agree with the above statement that there is equivalent security using a self-signed certificate as a commercially signed certificate?

Environment

Release:
Component: APIGTW

Resolution

The security of a client certificate is premised that a level of trust is established for validation that the client certificate was signed by a trusted source. That trusted source could be an internal CA provider owned by the company, external CA provider, or self signed. Either signed by an internal or external provider the main piece of trust comes from trusting the CA authority used and utilizing CRL/OSCP validation to ensure that even though the certificate has been signed it has not been revoked. With self signed certificates, this functionality is not available so it does not have the same advantage. This functionality can be added by doing what has been done by adding the certificate to a user within an LDAP, Federated, or Internal Identity provider user within the Gateway. If this user gets disabled or deleted then the capability to login will fail.