-2

I am writing a Java client to consume payment gateway rest services. If I want to create a HTTPS client that uses client certificates, from where to get certificate? Is it is something to ask from the team implementing the server?

I mean if server A is using certificateA, don't I need to copy the same certificate? Don't I need to ask payment gateway support team for certificates or I can get that on my own ??

5
  • You can get the certificate from anywhere you want.
    – Ramhound
    Commented Jun 25, 2015 at 10:18
  • No, I mean if server A is using certificateA, don't I need to copy the same certificate, I will be wrtting a java client to consume payment gateway rest services, so I need to ask payment gateway support team for certificates or I can get that on my own ?? Commented Jun 25, 2015 at 10:21
  • Yes; You need to add the certificate to your certificate store if its not trusted by default.
    – Ramhound
    Commented Jun 25, 2015 at 10:23
  • sorry again!! but it would be the same certificate as used by the server, or it can be different ?? And what if it is trusted?? Can you provide me reference on how to .. Commented Jun 25, 2015 at 10:24
  • If you are connecting to the server, over a secure https connection, then you have to trust the certificate. I know nothing about the chain on the certifcate. If the certificate isn't trusted you will get SSL/TLS errors related to that fact. Of course I would argue if you have to install the certificate then you are using the wrong payment processor
    – Ramhound
    Commented Jun 25, 2015 at 11:11

1 Answer 1

1

From where to get certificate at client end... Is it is something to ask from the team implementing the server??

You get a certificate from one of two places. First, if its for use within the organization and the organization runs its own PKI, then you get the PKI team to issue you a certificate.

If you need the certificate to be trusted outside the organization by many/most user agents, then you go to the CA Cartel. The cartel includes members like Symantec and VeriSign (in addition to the browsers).

There are members of the cartel who issue certificates for free. They are StartCom, CAcert and possibly Let's Encrypt. While they issue for free, they may charge for revocation because that's where the cost lies.


Don't I need to ask payment gateway support team for certificates or I can get that on my own ??

In this case, see if the Payment Gateway supports client certificates. If they do, get them to issue you one. If they don't then ask them what to do.

Not the answer you're looking for? Browse other questions tagged .