{"action":"created","comment":{"url":"https://api.github.com/repos/okta/okta.github.io/pulls/comments/44471948","id":44471948,"diff_hunk":"@@ -0,0 +1,324 @@\n+---\n+layout: blog_post\n+title: TLS Client Authentication for Internal Services\n+author: william_dawson\n+tags: [networking, security, architecture]\n+---\n+Computer networking is hard. Computer security is also hard. Together they’re\n+really hard. I was recently trying to configure TLS client authentication (also\n+referred to as mutual SSL) between a two internal services at Okta and found the\n+lack of complete examples astonishing. I hope that this blog post provides a\n+better understanding of how to accomplish client authentication in your own\n+applications and makes all that hard stuff a bit easier.\n+\n+## TLS Background\n+\n+In a normal TLS handshake, the server sends its certificate to the client so\n+that the client can verify the authenticity of the server. It does this by\n+following the certificate chain that issued the server's certificate until it\n+arrives at a certificate that it trusts. If the client reaches the end of the\n+chain without finding a certificate that it trusts, it will reject the\n+connection.\n+\n+{: style=\"text-align: center\"}\n+![TLS handshake](/assets/img/2015-10-29-tls-client-authentication-for-services-tls-handshake.png){: width=\"540px\"}\n+\n+In mutual SSL, the client also sends its certificate to the server\n+for the server to authenticate. The client is also burdened with providing an\n+additional message (called the CertificateVerify message), which assures the\n+server that the client is the true owner of the certificate. The server follows\n+the same process of checking the certificate chain until it finds one it trusts,\n+refusing the connection if it can't find such a certificate.\n+\n+## Implementing TLS Client Authentication\n+\n+In our case, the client and server are internal services communicating with each\n+other. I won't cover configuring a browser client or other clients that may be\n+not under your control. In this post, I’ll give examples for the technology we\n+use at Okta. Specifically, we use Dropwizard as the server framework and Jersey","path":"_source/_posts/2015-10-29-tls-client-authentication-for-services.md","position":40,"original_position":38,"commit_id":"e1cf2fa148b43ef97db61dfc91cf31da3e7f447e","original_commit_id":"9615510bcd7c51c40f61f6fe31a3e6e61b8233fd","user":{"login":"wdawson-okta","id":5238460,"avatar_url":"https://avatars.githubusercontent.com/u/5238460?v=3","gravatar_id":"","url":"https://api.github.com/users/wdawson-okta","html_url":"https://github.com/wdawson-okta","followers_url":"https://api.github.com/users/wdawson-okta/followers","following_url":"https://api.github.com/users/wdawson-okta/following{/other_user}","gists_url":"https://api.github.com/users/wdawson-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/wdawson-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wdawson-okta/subscriptions","organizations_url":"https://api.github.com/users/wdawson-okta/orgs","repos_url":"https://api.github.com/users/wdawson-okta/repos","events_url":"https://api.github.com/users/wdawson-okta/events{/privacy}","received_events_url":"https://api.github.com/users/wdawson-okta/received_events","type":"User","site_admin":false},"body":"I have some at the bottom for reference documentation, but I can add some here as well.","created_at":"2015-11-10T22:01:56Z","updated_at":"2015-11-10T22:01:56Z","html_url":"https://github.com/okta/okta.github.io/pull/99#discussion_r44471948","pull_request_url":"https://api.github.com/repos/okta/okta.github.io/pulls/99","_links":{"self":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/comments/44471948"},"html":{"href":"https://github.com/okta/okta.github.io/pull/99#discussion_r44471948"},"pull_request":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/99"}}},"pull_request":{"url":"https://api.github.com/repos/okta/okta.github.io/pulls/99","id":50293548,"html_url":"https://github.com/okta/okta.github.io/pull/99","diff_url":"https://github.com/okta/okta.github.io/pull/99.diff","patch_url":"https://github.com/okta/okta.github.io/pull/99.patch","issue_url":"https://api.github.com/repos/okta/okta.github.io/issues/99","number":99,"state":"open","locked":false,"title":"Wd tls client auth","user":{"login":"wdawson-okta","id":5238460,"avatar_url":"https://avatars.githubusercontent.com/u/5238460?v=3","gravatar_id":"","url":"https://api.github.com/users/wdawson-okta","html_url":"https://github.com/wdawson-okta","followers_url":"https://api.github.com/users/wdawson-okta/followers","following_url":"https://api.github.com/users/wdawson-okta/following{/other_user}","gists_url":"https://api.github.com/users/wdawson-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/wdawson-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wdawson-okta/subscriptions","organizations_url":"https://api.github.com/users/wdawson-okta/orgs","repos_url":"https://api.github.com/users/wdawson-okta/repos","events_url":"https://api.github.com/users/wdawson-okta/events{/privacy}","received_events_url":"https://api.github.com/users/wdawson-okta/received_events","type":"User","site_admin":false},"body":"New post about TLS client authentication\r\n\r\n@joelfranusic-okta \r\n\r\nFYI for the team:\r\n@jontodd @rgupta-okta @jeffpeeler-okta @rlucero-okta @croche-okta @guyzehavi-okta ","created_at":"2015-11-10T18:44:34Z","updated_at":"2015-11-10T22:01:56Z","closed_at":null,"merged_at":null,"merge_commit_sha":"3899d01a7c85644f8b151da543348ef5a51c0b9e","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/okta/okta.github.io/pulls/99/commits","review_comments_url":"https://api.github.com/repos/okta/okta.github.io/pulls/99/comments","review_comment_url":"https://api.github.com/repos/okta/okta.github.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/okta/okta.github.io/issues/99/comments","statuses_url":"https://api.github.com/repos/okta/okta.github.io/statuses/e1cf2fa148b43ef97db61dfc91cf31da3e7f447e","head":{"label":"wdawson-okta:wd-tls-client-auth","ref":"wd-tls-client-auth","sha":"e1cf2fa148b43ef97db61dfc91cf31da3e7f447e","user":{"login":"wdawson-okta","id":5238460,"avatar_url":"https://avatars.githubusercontent.com/u/5238460?v=3","gravatar_id":"","url":"https://api.github.com/users/wdawson-okta","html_url":"https://github.com/wdawson-okta","followers_url":"https://api.github.com/users/wdawson-okta/followers","following_url":"https://api.github.com/users/wdawson-okta/following{/other_user}","gists_url":"https://api.github.com/users/wdawson-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/wdawson-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wdawson-okta/subscriptions","organizations_url":"https://api.github.com/users/wdawson-okta/orgs","repos_url":"https://api.github.com/users/wdawson-okta/repos","events_url":"https://api.github.com/users/wdawson-okta/events{/privacy}","received_events_url":"https://api.github.com/users/wdawson-okta/received_events","type":"User","site_admin":false},"repo":{"id":45208055,"name":"okta.github.io","full_name":"wdawson-okta/okta.github.io","owner":{"login":"wdawson-okta","id":5238460,"avatar_url":"https://avatars.githubusercontent.com/u/5238460?v=3","gravatar_id":"","url":"https://api.github.com/users/wdawson-okta","html_url":"https://github.com/wdawson-okta","followers_url":"https://api.github.com/users/wdawson-okta/followers","following_url":"https://api.github.com/users/wdawson-okta/following{/other_user}","gists_url":"https://api.github.com/users/wdawson-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/wdawson-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wdawson-okta/subscriptions","organizations_url":"https://api.github.com/users/wdawson-okta/orgs","repos_url":"https://api.github.com/users/wdawson-okta/repos","events_url":"https://api.github.com/users/wdawson-okta/events{/privacy}","received_events_url":"https://api.github.com/users/wdawson-okta/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/wdawson-okta/okta.github.io","description":"Okta Identity Platform API Docs and Developer Home","fork":true,"url":"https://api.github.com/repos/wdawson-okta/okta.github.io","forks_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/forks","keys_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/teams","hooks_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/hooks","issue_events_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/events","assignees_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/tags","blobs_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/languages","stargazers_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/stargazers","contributors_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/contributors","subscribers_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/subscribers","subscription_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/subscription","commits_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/merges","archive_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/downloads","issues_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/labels{/name}","releases_url":"https://api.github.com/repos/wdawson-okta/okta.github.io/releases{/id}","created_at":"2015-10-29T20:14:54Z","updated_at":"2015-10-29T20:15:02Z","pushed_at":"2015-11-10T21:57:24Z","git_url":"git://github.com/wdawson-okta/okta.github.io.git","ssh_url":"git@github.com:wdawson-okta/okta.github.io.git","clone_url":"https://github.com/wdawson-okta/okta.github.io.git","svn_url":"https://github.com/wdawson-okta/okta.github.io","homepage":"http://developer.okta.com/","size":20486,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"okta:master","ref":"master","sha":"4e61759e85b2a6b48ab28980a648e0a2ae6d0358","user":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"repo":{"id":10953058,"name":"okta.github.io","full_name":"okta/okta.github.io","owner":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/okta/okta.github.io","description":"Okta Identity Platform API Docs and Developer Home","fork":false,"url":"https://api.github.com/repos/okta/okta.github.io","forks_url":"https://api.github.com/repos/okta/okta.github.io/forks","keys_url":"https://api.github.com/repos/okta/okta.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/okta/okta.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/okta/okta.github.io/teams","hooks_url":"https://api.github.com/repos/okta/okta.github.io/hooks","issue_events_url":"https://api.github.com/repos/okta/okta.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/okta/okta.github.io/events","assignees_url":"https://api.github.com/repos/okta/okta.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/okta/okta.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/okta/okta.github.io/tags","blobs_url":"https://api.github.com/repos/okta/okta.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/okta/okta.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/okta/okta.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/okta/okta.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/okta/okta.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/okta/okta.github.io/languages","stargazers_url":"https://api.github.com/repos/okta/okta.github.io/stargazers","contributors_url":"https://api.github.com/repos/okta/okta.github.io/contributors","subscribers_url":"https://api.github.com/repos/okta/okta.github.io/subscribers","subscription_url":"https://api.github.com/repos/okta/okta.github.io/subscription","commits_url":"https://api.github.com/repos/okta/okta.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/okta/okta.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/okta/okta.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/okta/okta.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/okta/okta.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/okta/okta.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/okta/okta.github.io/merges","archive_url":"https://api.github.com/repos/okta/okta.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/okta/okta.github.io/downloads","issues_url":"https://api.github.com/repos/okta/okta.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/okta/okta.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/okta/okta.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/okta/okta.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/okta/okta.github.io/labels{/name}","releases_url":"https://api.github.com/repos/okta/okta.github.io/releases{/id}","created_at":"2013-06-25T23:22:38Z","updated_at":"2015-10-08T20:20:22Z","pushed_at":"2015-11-10T21:57:24Z","git_url":"git://github.com/okta/okta.github.io.git","ssh_url":"git@github.com:okta/okta.github.io.git","clone_url":"https://github.com/okta/okta.github.io.git","svn_url":"https://github.com/okta/okta.github.io","homepage":"http://developer.okta.com/","size":23949,"stargazers_count":7,"watchers_count":7,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":25,"mirror_url":null,"open_issues_count":5,"forks":25,"open_issues":5,"watchers":7,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/99"},"html":{"href":"https://github.com/okta/okta.github.io/pull/99"},"issue":{"href":"https://api.github.com/repos/okta/okta.github.io/issues/99"},"comments":{"href":"https://api.github.com/repos/okta/okta.github.io/issues/99/comments"},"review_comments":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/99/comments"},"review_comment":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/99/commits"},"statuses":{"href":"https://api.github.com/repos/okta/okta.github.io/statuses/e1cf2fa148b43ef97db61dfc91cf31da3e7f447e"}}}}