I have a python application running behind an SSL nginx server.
In the nginx config I use "optional_no_ca" because I want to accept self signed certs.
My question is: can I blindly assume that the connection initiator is also the owner of the private part of the public key that I get in the certificate.
I.e. can I use the public key as the user id?
Yes, if the client authenticates with a certificate on SSL/TLS level, this confirms that the client has a corresponding private key.
Yet I would question the approach of using public keys as user IDs. Disclosure of the private key in this situation would need to replace the keypair and thus the user account should be discarded as well (if it's identified by the public key).
Another aspect is that the public keys and client-side certificates are not handy for users to manage.
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments