When using Client Certificates, is it usual to generate your own? We're building a webservice for a third party customer who wants us to use "two-way SSL". By which I understand them to mean they want us to host the site using https, and to require that include a Client Certificate in each http request.

I've been working through a number of examples on how to make all this work with the tooling we use, and I think I'm beginning to get a handle on it.

If I'm understanding correctly, we'll provide them with a certificate. They have their client include it in their requests, and we validate that the certificate we receive is what we expect.

What's not clear to me is whether it's usual for us to have the certificate created by a CA, or for us to do it ourselves. With SSL certificates, an unsigned cert is meaningless. But with client certs, we're expecting to receive a specific cert, so I'm not sure I see that validating that everything is signed back to a recognized root authority really matters.

Do people generally use CA-signed client certs, regardless?
In a typical business to business setting it may  be that the client is also a server for other use cases. In that case the server cert and corresponding private key of the other party could be reused. To be able to verify that it is correct you should probably pin (trust just that) certificate as you may not want to trust other certificates issued with a generic CA to connect - although you could also whitelist the particular server name.

Yes, it is perfectly valid to issue your own certs in this setting. For security reasons it is best if the other party creates a key pair with corresponding certificate request, which you then use to create a signed certificate that you can trust. For this you need a CA &amp; CA software (and trust your own CA certificate). You could also simply  trust a self signed certificate from the other party.

I think it generally just makes sense to use a normally issued certificate by a third party CA iff:


either you want to reuse the cert / key material and/or
you have some reason to only trust a cert with a particular host name.


Key management is a complicated matter. To avoid awkward conversations I would definitely ensure that you create the protocol together with the other party. Time for coffee and cookies!