Network and Security
Certificates and Identity
This page explains how a Remotle app knows it is talking to the right workstation, and how a workstation knows the person connecting may do so. It is for IT and security teams. The short version is on Security.
The trust chain
Section titled “The trust chain”| Level | What it is | Where the key lives |
|---|---|---|
| Root | Computle’s private root certificate authority. It signs intermediate certificates and nothing else. The root certificate is built into every Remotle app. | A hardware security module. Every use of the key is written to an audit log with alerting. |
| Intermediate | One per customer. It is name-constrained, so it can only sign certificates that name that customer’s workstations. | The same hardware security module. |
| Workstation | One per workstation, naming the workstation identifier and the customer. Valid for 30 days. | On the workstation. Where it has a TPM, the key is created in the TPM as a non-exportable key. Otherwise it is held in the Windows machine key store. The certificate authority receives only the public key. |
A name-constrained intermediate means a certificate for one customer’s workstation cannot be issued under another customer’s intermediate, and the app rejects a workstation whose certificate names a different customer from the one the user signed in to.
The life of a workstation certificate
Section titled “The life of a workstation certificate”| Issue | The workstation generates a key pair and sends the public key with its enrolment. The identity service for your organisation issues a certificate under your intermediate. |
| Register | The host registers with the connection service using the certificate, and the connection service records the public key. The app is later told exactly which key to expect. |
| Renew | At day 20 the host generates a fresh key pair, obtains a new certificate and re-registers so the connection service knows the new key. Nothing is reused. |
| Expiry | A host whose certificate has expired, for example after a long time switched off, renews it by itself and reconnects. |
| Revoke | Computle can revoke a workstation’s certificate. The connection service supplies the app with the revocation list, a revoked workstation is refused when it registers, and a connected one is dropped. |
What the app checks before showing a desktop
Section titled “What the app checks before showing a desktop”The checks happen during the QUIC handshake, before any picture is decoded. If any check fails, the app shows “This machine could not be verified. Do not enter credentials.” and does not offer a retry.
| Check | What it proves |
|---|---|
| The chain | The certificate chains to the Computle root built into the app, through an intermediate. A certificate from any other authority is refused. |
| The workstation | The certificate’s common name is the identifier of the workstation the person asked for. A different workstation cannot answer in its place. |
| The customer | The certificate names the customer the person signed in to. |
| The key | The certificate’s public key matches the one the workstation registered with the connection service. |
| Revocation | The certificate’s serial is not on the revocation list the connection service supplied. |
The per-session secret
Section titled “The per-session secret”After the handshake, each end proves knowledge of a per-session secret that the connection service delivered over its own authenticated control connection, combined with keying material exported from the TLS session. This binds the secret to this TLS connection and to nothing else. A host holding a valid certificate alone cannot complete a session without that secret, so a copied certificate and key cannot produce the proof.
Session tokens
Section titled “Session tokens”| What it is | A signed statement that this user may connect to this workstation now. |
| Signature | RSA, RS256, with your organisation’s own signing key. |
| Lifetime | Five minutes, usable once. The connection service checks the signature, the expiry, the customer, and that the token’s unique identifier has not been presented before. A replayed token is refused. |
| Where it comes from | The right to connect is a signed grant held in your organisation’s identity service, created when an administrator assigns the workstation. Removing the assignment stops new tokens being issued. See Assigning Workstations. |
| Reconnecting | When a session needs to re-establish its network path, the app obtains a new token without any user interaction. A resumed session is a new session with new secrets. |
| What it carries | The user, the workstation, the customer and the session policy that applies. See Session Policy. |
Tenant isolation
Section titled “Tenant isolation”Each customer has its own identity service instance, with its own database, its own signing keys for grants and tokens, its own certificate authority intermediate and its own encrypted backup store. An instance serves one customer and refuses a request for any other before performing any lookup. The shared connection service and relays identify every workstation by customer and machine, and a session token for one customer cannot reach another customer’s workstation.
Lifetimes
Section titled “Lifetimes”| Item | Lifetime |
|---|---|
| Workstation certificate | 30 days, renewed at day 20 with a new key |
| Workstation credential to the connection service | 30 days, renewed with the certificate |
| Session token | 5 minutes, single use |
| Resume ticket | 12 hours, held in memory only |
Related pages
Section titled “Related pages”Questions
Section titled “Questions”Do I need to install or trust any certificate on my network?
Section titled “Do I need to install or trust any certificate on my network?”No. The Computle root is built into the app, and the workstation obtains its own certificate when the host is installed. Nothing is added to your operating system’s certificate stores and no TLS inspection exception is needed for the session. See Proxies and TLS Inspection.
What happens if a workstation is cloned?
Section titled “What happens if a workstation is cloned?”Two machines holding the same certificate and key still cannot both complete a session. The connection service gives the session secret only to the registered workstation over its own authenticated connection, and Computle can revoke the certificate. Where the key is in the TPM it cannot be exported in the first place.
Does the certificate change when I rename a workstation?
Section titled “Does the certificate change when I rename a workstation?”The certificate names the workstation identifier, which stays the same when the display name changes in the console.
Can I see the certificate?
Section titled “Can I see the certificate?”On Windows it is in the machine certificate store. The Computle (Remotle) Host app shows the connection health that depends on it; see Host Status.