Commercial cert vs. Microsoft Certificate Services generated cert

Commercial cert vs. Microsoft Certificate Services generated cert
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Commercial cert vs. Microsoft Certificate Services generated cert Luckypolo 06-21-2007
Posted by =?Utf-8?B?THVja3lwb2xv?= on June 21, 2007, 4:23 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi all,

I am completely new to the certificate issues, so I guess my question is
kind of basic one. I was searching in the Web but now I have kind of mess of
information in my head ;) and I would like to make some order...

We are making a Web application which receives and sends some XML. We want
to make it working through the HTTPS. There will be more than one
installations of this application. We need to get a certificate for each of
those installations (as it is generated for a given DNS name), right?

I guess this is important to ensure that the client applications (not the
Web browser, just a dedicated application) will trust to the certificate used
by our application. So, as far as I read about it, there are two
possibilities to get such a certificate:

1. Order the certificate (for each DNS name) in a commercial world-wide
trusted certification agency.
2. Install and maintain Microsoft Certificate Services and produce our own
certificates (so it is making our own CA).

As far as I understand, if we choose to use Microsoft Certificate Services
and we want the client applications to trust to our certificate, we should
sign our certificates with the certificate which is signed by a world-wide
trusted CA. It means first we need to order one commercial certificate for
signing the certificates generated by our local CA. Is that correct?

Then the client applications will also trust to our certificate - and this
will be because there is a “certificate path” to the trusted root
certificate.
Is this certificate path included in the certificate itself? Is there any
performance issue connected to checking a certification path?

As we are responsible for all the installations of our application, the only
access to the Microsoft Certificate Services will be from inside of our
company. However, the certificates generated by the Microsoft Certificate
Services must be trusted by the client applications from outside of the
company.

Ok. Does it sound reasonable at all or I am missing the point?
What are the advantages/disadvantages of the points 1. and 2.?

I will be very thankful for answers.


Posted by S. Pidgorny on June 21, 2007, 6:00 am
If you were  Registered and logged in, you could reply and use other advanced thread options
G'day,

Your understanding of the situation is correct.

Getting your CA certificate signed by a commercial CA is quite expensive and
involves complicated procedures. This option isn't easily available.


--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

> Hi all,
>
> I am completely new to the certificate issues, so I guess my question is
> kind of basic one. I was searching in the Web but now I have kind of mess
> of
> information in my head ;) and I would like to make some order...
>
> We are making a Web application which receives and sends some XML. We want
> to make it working through the HTTPS. There will be more than one
> installations of this application. We need to get a certificate for each
> of
> those installations (as it is generated for a given DNS name), right?
>
> I guess this is important to ensure that the client applications (not the
> Web browser, just a dedicated application) will trust to the certificate
> used
> by our application. So, as far as I read about it, there are two
> possibilities to get such a certificate:
>
> 1. Order the certificate (for each DNS name) in a commercial world-wide
> trusted certification agency.
> 2. Install and maintain Microsoft Certificate Services and produce our own
> certificates (so it is making our own CA).
>
> As far as I understand, if we choose to use Microsoft Certificate Services
> and we want the client applications to trust to our certificate, we should
> sign our certificates with the certificate which is signed by a world-wide
> trusted CA. It means first we need to order one commercial certificate for
> signing the certificates generated by our local CA. Is that correct?
>
> Then the client applications will also trust to our certificate - and this
> will be because there is a "certificate path" to the trusted root
> certificate.
> Is this certificate path included in the certificate itself? Is there any
> performance issue connected to checking a certification path?
>
> As we are responsible for all the installations of our application, the
> only
> access to the Microsoft Certificate Services will be from inside of our
> company. However, the certificates generated by the Microsoft Certificate
> Services must be trusted by the client applications from outside of the
> company.
>
> Ok. Does it sound reasonable at all or I am missing the point?
> What are the advantages/disadvantages of the points 1. and 2.?
>
> I will be very thankful for answers.
>



Posted by Roger Abell [MVP] on June 21, 2007, 8:49 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
One other alternative, also not cheap, would be a wildcard cert
for SSL, which could work if all of your installs of the app ended
in say mycompany.com (app1.mycompany.com, etc.).
The price from a cert issuer in the public trust for wildcard SSL
cert is obviously than that of individual DNS host cert, but still
much below the licensing for issuing your own certs countersigned
by a public authority.

Roger

> Hi all,
>
> I am completely new to the certificate issues, so I guess my question is
> kind of basic one. I was searching in the Web but now I have kind of mess
> of
> information in my head ;) and I would like to make some order...
>
> We are making a Web application which receives and sends some XML. We want
> to make it working through the HTTPS. There will be more than one
> installations of this application. We need to get a certificate for each
> of
> those installations (as it is generated for a given DNS name), right?
>
> I guess this is important to ensure that the client applications (not the
> Web browser, just a dedicated application) will trust to the certificate
> used
> by our application. So, as far as I read about it, there are two
> possibilities to get such a certificate:
>
> 1. Order the certificate (for each DNS name) in a commercial world-wide
> trusted certification agency.
> 2. Install and maintain Microsoft Certificate Services and produce our own
> certificates (so it is making our own CA).
>
> As far as I understand, if we choose to use Microsoft Certificate Services
> and we want the client applications to trust to our certificate, we should
> sign our certificates with the certificate which is signed by a world-wide
> trusted CA. It means first we need to order one commercial certificate for
> signing the certificates generated by our local CA. Is that correct?
>
> Then the client applications will also trust to our certificate - and this
> will be because there is a "certificate path" to the trusted root
> certificate.
> Is this certificate path included in the certificate itself? Is there any
> performance issue connected to checking a certification path?
>
> As we are responsible for all the installations of our application, the
> only
> access to the Microsoft Certificate Services will be from inside of our
> company. However, the certificates generated by the Microsoft Certificate
> Services must be trusted by the client applications from outside of the
> company.
>
> Ok. Does it sound reasonable at all or I am missing the point?
> What are the advantages/disadvantages of the points 1. and 2.?
>
> I will be very thankful for answers.
>



Posted by =?Utf-8?B?THVja3lwb2xv?= on June 22, 2007, 3:35 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Svyatoslav and Roger, thank you for your answers.

Let me continue with collecting my conclusions:

A. Making our own CA which issues certificates and signs them with the
certificate which is signed by a world-wide trusted CA - it is an expensive
solution and involves complicated procedures.

B. Ordering a wild card certificate for the domain *.mycompany.com - it is
also expensive, but much more cheaper then the solution A

C. Ordering a certificate for an individual DNS name - it is relatively cheap.
I guess the coming question needs rather to search for the prices on the CA
websites, but perhaps you know:
When we have - let's say - 30 instalations: is the variant C (with 30
individual certificates) still cheaper than the variant B (with wild card
cert)?

D. Making our own root CA, but with our self-signed ceritficate. Then on the
machines running the client's applications "our root CA" should be somehow
added to the trusted agencies.

I will be very thankful for confirmation or further comments :)

Greetings,
Polo.

"Roger Abell [MVP]" wrote:

> One other alternative, also not cheap, would be a wildcard cert
> for SSL, which could work if all of your installs of the app ended
> in say mycompany.com (app1.mycompany.com, etc.).
> The price from a cert issuer in the public trust for wildcard SSL
> cert is obviously than that of individual DNS host cert, but still
> much below the licensing for issuing your own certs countersigned
> by a public authority.
>
> Roger
>
> > Hi all,
> >
> > I am completely new to the certificate issues, so I guess my question is
> > kind of basic one. I was searching in the Web but now I have kind of mess
> > of
> > information in my head ;) and I would like to make some order...
> >
> > We are making a Web application which receives and sends some XML. We want
> > to make it working through the HTTPS. There will be more than one
> > installations of this application. We need to get a certificate for each
> > of
> > those installations (as it is generated for a given DNS name), right?
> >
> > I guess this is important to ensure that the client applications (not the
> > Web browser, just a dedicated application) will trust to the certificate
> > used
> > by our application. So, as far as I read about it, there are two
> > possibilities to get such a certificate:
> >
> > 1. Order the certificate (for each DNS name) in a commercial world-wide
> > trusted certification agency.
> > 2. Install and maintain Microsoft Certificate Services and produce our own
> > certificates (so it is making our own CA).
> >
> > As far as I understand, if we choose to use Microsoft Certificate Services
> > and we want the client applications to trust to our certificate, we should
> > sign our certificates with the certificate which is signed by a world-wide
> > trusted CA. It means first we need to order one commercial certificate for
> > signing the certificates generated by our local CA. Is that correct?
> >
> > Then the client applications will also trust to our certificate - and this
> > will be because there is a "certificate path" to the trusted root
> > certificate.
> > Is this certificate path included in the certificate itself? Is there any
> > performance issue connected to checking a certification path?
> >
> > As we are responsible for all the installations of our application, the
> > only
> > access to the Microsoft Certificate Services will be from inside of our
> > company. However, the certificates generated by the Microsoft Certificate
> > Services must be trusted by the client applications from outside of the
> > company.
> >
> > Ok. Does it sound reasonable at all or I am missing the point?
> > What are the advantages/disadvantages of the points 1. and 2.?
> >
> > I will be very thankful for answers.
> >
>
>
>

Posted by S. Pidgorny on June 22, 2007, 8:14 am
If you were  Registered and logged in, you could reply and use other advanced thread options
A,B - yes
C - shop around
D - yes (also cost involved although indirect)

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

> Svyatoslav and Roger, thank you for your answers.
>
> Let me continue with collecting my conclusions:
>
> A. Making our own CA which issues certificates and signs them with the
> certificate which is signed by a world-wide trusted CA - it is an
> expensive
> solution and involves complicated procedures.
>
> B. Ordering a wild card certificate for the domain *.mycompany.com - it is
> also expensive, but much more cheaper then the solution A
>
> C. Ordering a certificate for an individual DNS name - it is relatively
> cheap.
> I guess the coming question needs rather to search for the prices on the
> CA
> websites, but perhaps you know:
> When we have - let's say - 30 instalations: is the variant C (with 30
> individual certificates) still cheaper than the variant B (with wild card
> cert)?
>
> D. Making our own root CA, but with our self-signed ceritficate. Then on
> the
> machines running the client's applications "our root CA" should be somehow
> added to the trusted agencies.
>
> I will be very thankful for confirmation or further comments :)
>
> Greetings,
> Polo.
>
> "Roger Abell [MVP]" wrote:
>
>> One other alternative, also not cheap, would be a wildcard cert
>> for SSL, which could work if all of your installs of the app ended
>> in say mycompany.com (app1.mycompany.com, etc.).
>> The price from a cert issuer in the public trust for wildcard SSL
>> cert is obviously than that of individual DNS host cert, but still
>> much below the licensing for issuing your own certs countersigned
>> by a public authority.
>>
>> Roger
>>
>> > Hi all,
>> >
>> > I am completely new to the certificate issues, so I guess my question
>> > is
>> > kind of basic one. I was searching in the Web but now I have kind of
>> > mess
>> > of
>> > information in my head ;) and I would like to make some order...
>> >
>> > We are making a Web application which receives and sends some XML. We
>> > want
>> > to make it working through the HTTPS. There will be more than one
>> > installations of this application. We need to get a certificate for
>> > each
>> > of
>> > those installations (as it is generated for a given DNS name), right?
>> >
>> > I guess this is important to ensure that the client applications (not
>> > the
>> > Web browser, just a dedicated application) will trust to the
>> > certificate
>> > used
>> > by our application. So, as far as I read about it, there are two
>> > possibilities to get such a certificate:
>> >
>> > 1. Order the certificate (for each DNS name) in a commercial world-wide
>> > trusted certification agency.
>> > 2. Install and maintain Microsoft Certificate Services and produce our
>> > own
>> > certificates (so it is making our own CA).
>> >
>> > As far as I understand, if we choose to use Microsoft Certificate
>> > Services
>> > and we want the client applications to trust to our certificate, we
>> > should
>> > sign our certificates with the certificate which is signed by a
>> > world-wide
>> > trusted CA. It means first we need to order one commercial certificate
>> > for
>> > signing the certificates generated by our local CA. Is that correct?
>> >
>> > Then the client applications will also trust to our certificate - and
>> > this
>> > will be because there is a "certificate path" to the trusted root
>> > certificate.
>> > Is this certificate path included in the certificate itself? Is there
>> > any
>> > performance issue connected to checking a certification path?
>> >
>> > As we are responsible for all the installations of our application, the
>> > only
>> > access to the Microsoft Certificate Services will be from inside of our
>> > company. However, the certificates generated by the Microsoft
>> > Certificate
>> > Services must be trusted by the client applications from outside of the
>> > company.
>> >
>> > Ok. Does it sound reasonable at all or I am missing the point?
>> > What are the advantages/disadvantages of the points 1. and 2.?
>> >
>> > I will be very thankful for answers.
>> >
>>
>>
>>



Similar ThreadsPosted
Root CA cert expires, I renewed but I'm unable to request new cert March 7, 2006, 3:16 pm
Computer cert/User cert 802.x Authentication query August 7, 2007, 5:20 am
Problems Installing Win2K3 Cert services March 20, 2007, 10:28 pm
Re: EFS Certificate Self Signed Vs. User Cert May 26, 2005, 12:28 am
requesting cert from local CA: "no trusted certificate authorities available" November 6, 2006, 12:58 pm
Non-MS Cert Req -- How to sign with Microsoft CA? August 24, 2006, 3:56 pm
US-CERT - Microsoft Updates for Multiple Vulnerabilities July 10, 2007, 8:23 pm
how do i export a cert from my ca? February 16, 2006, 10:27 pm
Cert Server and RMS August 23, 2006, 1:35 pm
Non-domain Cert-based 802.1x using IAS November 15, 2005, 12:21 pm

The site map in XML format XML site map

Contact Us | Privacy Policy