Web应用程序之间的通信，有1个SSL证书，其他没有

Question

This the situation: I have one webservice without SSL, which provides two pages for the other web application. When the user submits these pages, an XML file with private information is sent to the webservice.

How can I provide the necessary privacy protection on the XML file? Is the one certificate good enough to give the appropriate security?

I'm not sure about this one, and am in the preparation phase of a project... So need to know the involved work on this part...

Answer 1

Certificates are tied to the hostname of the server (or, with wildcard certificates, all the hosts in a domain). So if the two services are on the same host, then both can use the same certificate.

If they are not on the same host there will be no transport security on the non-SSL service unless this is added separately. WCF has support for message (or part of message) encryption.

Answer 2

As an alternative to SSL you could encrypt the file yourself using any of the algorithms available in using System.Security.Cryptography but then you have to work out a mechanism to exchange your key(s).

However by far the easiest way will be to have both web services using SSL endpoints. That will take care of all your confidentiality, integrity and identity considerations in one fell swoop.

Answer 3

The simplest solution is certainly to use TLS, ex-SSL (widely supported in every programming language).

There is no need to buy a certificate (and it brings no extra security, it is mostly there to make PHBs feel better): either create self-signed certificates or set up your own CA.