Can anyone help me to identify the certificate requirement for the below scenario
We are planning to implement ssl for our b2b product
Server : Apache webserver
Client : JAVA based Product(not browser)
1. Server should authenticate the client.
2. Client should authenticate the server.
3. Server should encrypt and decrypt the message
4. Client should encrypt and decrypt the message
Now for Point 2 to 3 (server side certificate) my understanding is
a. I should generate private key, csr and then get it signed from authorities like verisign.
b. Place the private key and the certificate at the server side
c. Place the certificate (publickey+certificate) and root certificate at client side
The server will decrypt and encrypt the messages using the its private key, the client will authenticate the server and encrypt and decrypt the message using server's public key + certificate.
Now If have to implement point 1 (server authenticating the client) do I have to get another certificate for the client?
If I have separate certificate for the client I have to have private key also for the client. In that case how the encryption, decryption does happen?
In my client's(JAVA based Product) if I have to enable the ssl for point 1 I have to specify the client certificate and the private key(It expects the client certificate and private key. In that case both client and server will have its own private key. I am little confused how encryption and decryption will happen if both client and server has its own private key?
Can any one help me to clarify the above.
Thanks in advance
Babu
