For high-security scenarios such as financial transactions, healthcare, banking, and online payments, traditional one-way authentication, which verifies only the server's identity, is often insufficient. In a one-way authentication model, the server trusts any client that connects to it, which can lead to security risks such as man-in-the-middle attacks and unauthorized access. You can use the HTTPS mutual authentication feature of Anti-DDoS Proxy to enhance security. Mutual authentication requires both the client and the server to verify each other's identity before establishing a secure communication channel. This topic describes how to configure mutual authentication.
How it works
Why use mutual authentication
Most web applications use one-way authentication to establish HTTPS connections. The client verifies the server's identity, ensuring it connects to the correct server.
For applications that require higher security, the server must also verify the client's identity. Mutual authentication ensures that only authorized clients can access the service, reducing risks such as man-in-the-middle attacks and unauthorized access.
Comparison of one-way and mutual authentication
Item | One-way authentication | Mutual authentication |
Certificate files | Server certificate: | Server certificate: Client certificate: root CA certificate
|
Handshake process |  |  |
Use cases
For business scenarios with high-security requirements, such as financial transactions, healthcare, banking, Internet of Things (IoT), and online payments, you must also verify the client's identity.
If client identity verification is not required, you do not need to use mutual authentication.
Example scenario
Consider an e-government service platform that uses Anti-DDoS Proxy to defend against DDoS attacks. To prevent attackers from spoofing the platform's domain name, luring users to phishing websites that cause data breaches, or scraping public APIs with automated tools, configure HTTPS mutual authentication when you add the domain to Anti-DDoS Proxy.
Server authentication: The client verifies the server certificate configured on Anti-DDoS Proxy to ensure that it connects to a legitimate server.
Client authentication: Anti-DDoS Proxy verifies the client certificate against a configured CA certificate, allowing only authorized clients to connect.
Step 1: Create CA and client certificates
Method 1: Alibaba Cloud CA
For more information, see Apply for a private certificate.
Purchase and enable a private CA.
Note A private CA can contain one or more subordinate CAs under a root CA. Only subordinate CAs can issue private certificates, including server certificates and client certificates.
Use a private subordinate CA to apply for a client certificate.
Log on to the Certificate Management Service console. In the left-side navigation pane, choose .
On the Private CAs tab, find the target subordinate CA and click Apply for Certificate in the Actions column.
In the Apply for Certificate panel, configure the certificate information and click Confirm.
In this scenario, set Certificate Type to Client Certificate, and for Personal Name, enter the client user's unique identifier. You can keep the default values for other parameters or modify them as needed.
After you submit the application, the private CA immediately issues the certificate. You can then click Certificates in the Actions column for the intermediate CA to view the issued certificate.
Export the client certificate.
On the Private CAs tab, find the target subordinate CA and click Certificates in the Actions column.
On the Certificates page, find the target private certificate and click Download in the Actions column.
In the Download Certificate dialog box, select the required certificate format and click Confirm and Download. Select the Include Trust Chain checkbox to include the full certificate chain.
In this scenario, set Certificate Format to PFX, which is recognized by browsers.
The downloaded file package includes a client certificate file with the .pfx suffix and a text file with the .txt suffix that contains the password for the client's private key.
For example, client-alb.pfx and pfx-password.txt.
Method 2: Self-signed CA
You can use either a self-signed root CA certificate or a self-signed subordinate CA certificate for mutual authentication. This example uses a self-signed root CA certificate.
Use OpenSSL to generate a self-signed root CA certificate.
Run the following command to create a private key for the root CA certificate:
openssl genrsa -out root.key 4096
Run the following command to create a certificate signing request (CSR) for the root CA certificate:
openssl req -new -out root.csr -key root.key
Enter the required information as prompted. The following code provides an example:
Note Make sure that the Common Name for the CA certificate is unique and not the same as the Common Name for the server certificate or the client certificate.
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:bj
Locality Name (eg, city) [Default City]:bj
Organization Name (eg, company) [Default Company Ltd]:alibaba
Organizational Unit Name (eg, section) []:test
Common Name (eg, your name or your servers hostname) []:root
Email Address []:a****@example.com
A challenge password []:
An optional company name []:
Run the following command to create the root CA certificate:
openssl x509 -req -in root.csr -out root.crt -signkey root.key -CAcreateserial -days 3650
The following output is returned:
Signature ok
subject=C = cn, ST = bj, L = bj, O = alibaba, OU = test, CN = root, emailAddress = a****@example.com
Getting Private Key
Run the ls command to view the generated root CA certificate root.crt and its private key root.key.
You can download these root CA certificate files to your computer for later use.
Use the root CA certificate to generate a client certificate.
Run the following command to generate a private key for the client certificate:
openssl genrsa -out client.key 4096
Run the following command to generate a CSR for the client certificate:
openssl req -new -out client.csr -key client.key
Enter the required information as prompted. The following code provides an example:
Note Make sure that the Common Name for the client certificate is unique and not the same as the Common Name for the server certificate, root certificate, or any other client certificate.
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:bj
Locality Name (eg, city) [Default City]:bj
Organization Name (eg, company) [Default Company Ltd]:alibaba
Organizational Unit Name (eg, section) []:test
Common Name (eg, your name or your servers hostname) []:client-alb-user
Email Address []:username@example.com
A challenge password []:
An optional company name []:
Run the following command to generate the client certificate.
openssl x509 -req -in client.csr -out client.crt -CA root.crt -CAkey root.key -CAcreateserial -days 3650
The following output is returned:
Signature ok
subject=C = cn, ST = bj, L = bj, O = alibaba, OU = test, CN = client-alb-user, emailAddress = username@example.com
Getting CA Private Key
Run the following command to convert the generated client certificate client.crt to a PKCS12 file, which is recognizable by browsers. Enter the client private key encryption password as prompted.
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
Run the ls command to view the generated client.p12 client certificate file.
You can download the client certificate file to your computer for later use on the client.
Upload the self-signed root CA certificate to Alibaba Cloud Certificate Management Service.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose .
On the Certificate Application Repository page, click Create Repository. In the Create Repository panel, set Data Source to Uploaded CA Certificates, and then click OK.
Set Repository Name to Custom-CA.
On the Certificate Application Repository page, click the repository you created.
On the Certificate Management page, click Upload Certificate. In the CA Information panel, upload the root CA certificate file root.crt, and click Confirm and Enable.
Step 2: Configure domain and authentication
Log on to the Website Config page in the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
On the Website Config page, click Add Website and follow the prompts to add your domain.
This topic describes only how to enable mutual authentication. For information about other parameters, see Add a website.
In the HTTPS configuration section, select the Mutual Authentication checkbox. From the Select CA Certificate Source drop-down list, select the certificate source. From the Select Default CA Certificate drop-down list, select the corresponding CA certificate.
After the configuration is complete, copy the CNAME address. It is displayed below the domain name on the Website Config page. You need this value to configure domain name resolution.
Step 3: Configure domain name resolution
In production, point your domain name to the Anti-DDoS Proxy CNAME address by creating a CNAME record.
This topic uses a domain name whose DNS is hosted on Alibaba Cloud DNS as an example. If you use a different DNS service provider, this information is for reference only.
Log on to the Alibaba Cloud DNS console.
On the Authoritative DNS Resolution page, find the target domain and click Settings in the Actions column.
On the Settings page, find the record that you want to modify and click Edit in the Actions column.
Note If the record is not in the list, click Add Record.
In this scenario, set Record Type to CNAME and Record Value to the CNAME address of Anti-DDoS Proxy. You can keep the default values for other parameters or modify them as needed.
Click OK and wait for the DNS settings to take effect.
Step 4: Test HTTPS mutual authentication
This example uses the Chrome browser on a Windows client for testing.
Install the client certificate from Step 1 on the client device.
Double-click the downloaded client certificate file and follow the operating system's import wizard to complete the installation.
In your browser, enter https://<your_domain_name>. When prompted, select the certificate to use for client identity verification.
Refresh the browser and verify that you can access the domain.