2

I'm setting up a secure link between client machines and an SQL database server on a intranet without Internet-access.

The question I have is if I can buy and use a cert from a trusted CA on a local offline intranet without getting any message boxes about things like being unable to verify the validity of the certificate, if it has been revoked etc?

If not, then maybee it's just as good to have a self-signed CA (where I'm sure to get a message about giving trust to a unknown CA when installing the cert...)

Improve this question

1 Answer 1

Reset to default
2

A trusted CA does not require online connectivity to validate the certificate. The certificate is signed with a chain of signatures that is rooted in a private key for which the corresponding public key is already present in your system (this is what 'trusted CA' means, after all). You may be thinking at the certificate revocation list, which must be periodically refreshed online, but the system will work with even if the CRL cannot be refreshed.

Within an intranet there are options to use a corporate CA, but it does require a domain and PKI deployed.

Self-signed certificates with SQL Server provide only encryption, no server authentication. See Using Encryption Without Validation. There are no dialogs to popup for the clients, your connection attempt succeed or fails depending on a number of factors (read the article linked).

Improve this answer
6
  • When are the trusted CA public keys installed? If the client never have internet access, can they still make use of this kind of server authentication certificates on a intranet? Without ever refreshing the revocation list?
    – Andreas Zita
    Commented Aug 25, 2014 at 9:25
  • The OS comes with the CA public keys installed. See Windows Root Certificate Program - Members List (All CAs)
    – Remus Rusanu
    Commented Aug 25, 2014 at 10:08
  • I see, but can a client use a cert from one of these root CA's without ever having internet access? Will a cert be valid until it expires even though it could have been revoked without any way of knowing it...?
    – Andreas Zita
    Commented Aug 25, 2014 at 11:19
  • Yes. Certificates signed by a root CA are trusted, as long as valid. If required by your site policies, there are offline CRL update procedures. See CA Maintenance and How Certificate Revocation Works. This is a vast subject, if you want to know more details consider investing some time into reading the related MSDN articles.
    – Remus Rusanu
    Commented Aug 25, 2014 at 11:27
  • Probably you can find some books on the topic too (specific Windows PKI and CA administration and maintenance) but I cannot recommend one.
    – Remus Rusanu
    Commented Aug 25, 2014 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.