search

johannes-staehlin / cordova-client-cert-authentication

Client Certificate Authentication for Android Cordova
Apache License 2.0
6 stars 8 forks source link

Setting up a test server on the cloud? #7

Closed brodycj closed 5 years ago

brodycj commented 5 years ago

I am working on a solution for iOS (#5) and could use a guide how to setup a test server. I would very likely favor a solution based on Node.js.

I found a nice writeup for running a Node.js test server on localhost at https://medium.com/@sevcsik/authentication-using-https-client-certificates-3c9d270e8326. But I would rather test on a remote server, with a real device if possible.

My first choice cloud provider is Zeit now.js, already raised zeit/now-cloud#78 in case I can get help there. I think my second choice is DigitalOcean, found a tutorial with no client certificate authentication at: https://code.lengstorf.com/deploy-nodejs-ssl-digitalocean/

P.S. Nice quickstart for Node.js with letsencrypt certificate at: https://itnext.io/node-express-letsencrypt-generate-a-free-ssl-certificate-and-run-an-https-server-in-5-minutes-a730fbe528ca - worked like a charm once I got HTTP server working on DigitalOcean.

johannes-staehlin commented 5 years ago

The linked article already describes how to simply setup a simple test server. You should also be able to deploy this on any PaaS of your choice. Only thing to make sure is that your alice/bob client-certs are of course not singed by a self-signed certificate but by an actual SSL certificate.

I don't know if the provider you mentioned offers you access to the actual server_certificate or handles everything in the background for you.

johannes-staehlin commented 5 years ago

If you are just looking for a simple server where you can test if client-cert is working, checkout https://badssl.com/

I tested it with Firefox:

  1. download badssl.com-client.p12 from https://badssl.com/download/
  2. In Firefox go to preferences > Privacy & Security > View Certificates... > Your Certificates > Import... and import the certificate
  3. open https://client.badssl.com/ (should show a fancy green page)

If you skip step 2 or remove the client certificate again, the request to https://client.badssl.com/ will fail with 400 Bad Request.

brodycj commented 5 years ago

Thanks @johannes-staehlin for the help, badssl.com seems to do the trick for me.

The need to use the actual SSL certificate to sign the client certificate makes absolute sense to me. Unfortunately I couldn't get that to work so far, will probably try it again someday and post if it succeeds. (I was hoping to test with more client certificates.)