SSL and certificates

[Kevin]

Are client certificates necessary for SSL or just server
certificates?

The Microsoft help for setting up SSL takes you through
creating a server root certificate and another server
certificate and then installing each on all of the
clients. But other documentation that I have read
suggests that SSL only needs server certificates and that
client certificates are only needed for certificate
authentication. I want to use forms authentication and
don't won't to force our customers to deploy client
certificates if they don't have too.

 

[Thomas Møller Jensen]

You only need a server certificate for having users authenticate securely
with forms authentication over a SSL encrypted connection. In this scenario
the users are authenticated using their username and password, submitted to
the server over SSL.

Client certificates is not used for securing the connection between client
and server, but only to authenticate users. In this kind of scenario the
users does not submit their username/password for authentication, but
instead uses their client certificate to authenticate.

 

[Alun Jones [MS MVP]]

Are client certificates necessary for SSL or just server
certificates?

Just a server certificate. However...

The Microsoft help for setting up SSL takes you through
creating a server root certificate and another server
certificate and then installing each on all of the
clients.

The client needs to have some way to believe that the server's certificate
is genuine. It does that either by trusting the server's certificate, or
one of the certificates that were used to sign the server's certificate.

This is where installing the certificates comes in - your client only trusts
those certificates that it has been told to trust. Internet Explorer ships
with a few certificates already described as "trusted" - these are generally
root certification authorities, and IE will implicitly trust any server that
presents a certificate signed by one of these Trusted Roots.

To get your server certificate trusted by a client's installation of IE, you
have to do one of the following:

1. Get your certificate from a CA that is already a trusted root at the
client's IE installation.
2. Have the client install your server's certificate as trusted.
3. Have the client install as trusted the certificate from the CA that
issued your server's certificate.

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.]