client side SSL cert

how to set up

[millyre]

I'd like to strengthen security for our web app using client side certificates. I've managed to set up a test server with self-signed CA, server cert and client side certs on the browsers.

Everything seem to run okay, but I would like to know if there are things I should be aware of, gotchas etc regarding the security of this scheme.

My objective is to restrict access to selected PCs, with additional password authentication and IP check at the server.

As this particular web site will not be available to the general public, I think that self-signed certificates should be good enough.

To avoid warnings, I just install the CA cert on the browsers accessing the server, plus the client side certs. The client side certs will be issued with a 'lifetime' of 2-4 weeks maximum, and in addition there will be password authentication.

Is this good enough? I am concerned that someone will steal/export the certs from the browser, install it elsewhere (e.g. a net cafe), and happily circumvent my 'security scheme'.

Comments appreciated!

[millyre]

update:

I think I got the terms wrong. WHen I write 'client side' certificates, I mean *client certificates* (which reside client side of course)

[jtara]

If it's that sensitive, don't use certificates. I have to assume this is for a high-value subscription service. Use a security token.

That could be defeated, as well, but it would take your client being on the phone with the duplicate user when they log in.

[millyre]

No, it is not a subscription service. It is for access to a web app on a remote site for customer reps. Most of the access wil be from the central office where the setup is quite secure. I would like to control the access from elsewhere as tight as possible, and was thinking of using a combination of ssl certs, IP check and passwords.

I've also been considering VPN, SSH. But these rely on certs as well for secure setups. And as everything is web based, SSL seem to be the right choice.