Why to digitally sign an http request over SSL

user_1530674 0
Viewed 667

I came across this question and couldn't get why someone needs to digitally sign a request that is submitted over SSL

  1. Digital Signature aims to guarantee message integrity by identifying the sender and making sure that the message is not getting altered between client and server
  2. SSL aims to secure the communication channel between client and server to prevent sniffing and MITM attack and hence guarantees that messages cannot be altered

Can't one of the above approaches replace the other?

For example:

  • Over SSL, can I just rely on authentication header to identify the sender without digitally sign the request as I guarantee that SSL protects the request from MITM?

Or

  • Can I trust digitally signed messages over http because the server will know the source of the message and can identify if it was altered or not?
digital-signature https ssl security
1 Answers

By using only SSL you guarantee that message is not altered during transmission, which is good, but it says nothing about sender, basically any client can establish ssl connection with server and send data to it.

With signature server has ability to validate not only that data was not tempered, but also that this particular client generated them.

user_28642750
Related