1

I have my own application. My client wants me to use their web service. This web service sends some data to my database. For this, my client wants a certificate from me. In this scenario, what kind of certificate should I provide?

Limit
  • 3,191
  • 1
  • 16
  • 35
user136861
  • 21
  • 2
  • 1
    What do you mean by what kind of certificate? "self signed/CA signed type" ? – Limit Jan 20 '17 at 18:24
  • Exactly, in this scenario what kind of certificate I should send to my client? I am not sure from my end. Please advice. – user136861 Jan 20 '17 at 19:19
  • Well, CA signed is almost always the preferred choice. Self signed will become difficult to maintain – Limit Jan 20 '17 at 19:38

2 Answers2

2

A self signed certificate of sufficient key size (2048 bit) would be fine. You wouldn't need a CA signed certificate as the client can add the certificate to their credential store. Use OpenSSL for the purpose.

hax
  • 3,851
  • 1
  • 16
  • 34
0

If the client web services have access to the internet or they have a local CA, then I would suggest that you use CA signed certificates.

Otherwise it is fine to use self signed certificates in your case but it will be a headache especially if the client has multiple web services and you want to update the certificate.

Here is a comparison of different ways to use certificates in SSL

Community
  • 1
Limit
  • 3,191
  • 1
  • 16
  • 35