Web service security with X.509 certificate. What's better?

Question

I am pretty newbie, so please carry me. I have a web service developed with WCF that will be used by a non .NET client. I am currently looking to provide it. I came to the conclusion that the best option is to use WsHttpBinding and an X509 certificate. However, when it comes to obtaining a certificate, I get a little lost. Is the X509 the same as an SSL certificate? What is the best certificate I should look for for such a scenario?

Answer 1

Chia hopes these 2 will help you; I used it in my previous project; (Yes)

http://www.phildev.net/ssl/ssl_talk_uuasc.pdf

https://security.stackexchange.com/questions/1438/what-is-the-difference-between-an-x-509-client-certificate-and-a-normal-ssl-ce

http://www.ipsec-howto.org/x595.html

Chrees!

Answer 2

You are close. SSL uses x.509 certificates. x.509 is a certificate standard. This is what allows Firefox to understand the certificate provided by IIS. But x.509 certificates are used much more than just SSL. It is also used for signing documents, signing applications, secure key exchange and others.

SSL (Secure Sockets Layer) is a secure communications protocol that uses these certificates, in particular, to authenticate your service. When a client connects to your service, it presents an x.509 certificate bound to your domain, which is signed by a certification authority (CA) that the client trusts. Most often, it is bought from a third-party CA, for example Verisgn, GoDaddy, Entrust, or countless others.

Edited based on new comments:

If it is open to the public, you will definitely want to purchase a certificate from a third-party CA. Verisign is the largest, but they are also the most expensive.

It is also important to note that SSL and certificates do not really make the web service “secure”. It simply protects communication with the client and does not allow attackers to impersonate you. There may be other security issues.