In part 1 of this feature, we discussed the process for obtaining and installing a server certificate for SSL enablement in IIS 6.0. This will provide confidentiality to HTTP sessions created between the server and its clients. To enable authentication of the users, however, you must enable mutual authentication. This will require the users of the system to have obtained digital signature credentials, or they will not be able to access the system! Start the Internet Services Manager by selecting Start -> Administrative Tools -> Internet Services Manager. (Note: in various versions of Windows, this shortcut may contain a slightly different path in the Start menu.) Right-click the web site node in the IIS manager, and open the Properties dialog.[…]
Author: Walt Turnes
This week’s tool, SimpleCAPI, is brought to you by Gemini Security Solutions. This is how it is described on the Gemini Security web site: Our custom application, SimpleCapiUI provides the ability to quickly check the revocation status of certificates stored in CAPI, but it also provides drag-and-drop functionality so that a user can install certificates into CAPI by dragging a certificate, PKCS#12 key file, or PKCS #7 signature file onto the interface. Additionally, an entire folder may be dropped into the application and SimpleCapiUI will scan the folder recursively to find certificates to install. By reducing the complexity of dealing with the Windows certificate store, SimpleCapiUI streamlines the process of testing PKI-enabled software. This covers just about all of the[…]
This from BetaNews (link opens in new window): Giving a nod to developers who’ve apparently given a lot of feedback, as well as “certain commercials,” Microsoft’s platform chief Steven Sinofsky acknowledged that perhaps User Account Control in Windows Vista may have been…a little annoying. In turn, Windows 7 has additional UAC settings. Fortunately for my own sanity, I haven’t had to jump through any hoops with UAC to get my code working, but that’s mostly because I deal with server-side code now. While the developer perspective is interesting, it’s really the user perspective that’s important to me, as someone who is concerned with the overall state of desktop security. Developers are not only in the minority, we also don’t have[…]
Data confidentiality and user authentication are often important design requirements when implementing web applications, particularly within a corporate Intranet. If a PKI is in place within an organization, these two goals can be achieved by enabling the web server to use SSL with client certificate authentication. The SSL encryption layer protects data in transit, while the client certificate authentication component requires users to present proof of identity before allowing access.
In order to require client certificate authentication, first the web server must obtain an SSL server certificate. This certificate may be obtained from any trusted certification authority, including an internal issuer or a public issuer such as VeriSign. First, you must create the Certificate Request using the following steps:
Recently, I was buying a bottle of wine at the grocery store and was asked to show my ID. My license picture was taken about 4 years ago, when I was 20-30 lbs lighter and before I started shaving my head, so it doesn’t look all that much like me anymore. The clerk was skeptical, and he asked me to show another form of ID, which I provided by showing him a few credit cards. Apparently, that was enough to convince him that I was who the license said I was. What if I had just stolen someone’s wallet, though? I would have easily been able to produce credit cards that accompanied the license in the wallet. Showing that extra[…]
Authoring web sites was a lot easier in the 90’s…write some static HTML, maybe some JavaScript, and you were done. Need to update the site? Just edit the HTML pages and upload. In the past decade or so, web applications have made a lot of progress with interactivity and dynamic content. Services hosted outside of the application container, such as third party web services and databases, can provide a boatload of flexibility when designing and implementing a web site. But, these services rarely, if ever, allow anonymous interaction…so we need to go back to our old friend, the password. Passwords are usually stored in a configuration file along with a web application. The configuration files are generally not made accessible[…]