Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server certificate, it gives me a security risk warning. Is there a way to make it not give the warning?

All I basically want to know is, is it possible to make self signed certificate trusted?

share|improve this question
4  
@CristianTM STFW nature is not inherently bad if your goal is to have a comprehensive Q&A archive on a topic. – alcedine Feb 4 at 15:40
37  
A self-signed certificate is like making a gold-colored badge looking thing in your home and then going around showing it to people saying you're a police officer. Maybe you can pull that trick with members of your family who accept that you're in charge, but if you want to be a real, public, law enforcement official, you have to be trusted by a central authority that everyone else trusts, like the government of your town or city or state. Otherwise, you're just impersonating a police officer and people would be wise to distrust you. – Todd Wilcox Feb 4 at 16:41
    
This is why we don't accept self-signed certs: > Please excuse Juan's absence from school yesterday. > > -Epstein's Mother. (If you aren't familiar with the TV program Welcome Back, Kotter, you might not get the reference.) – Monty Harder Feb 4 at 17:35
    
@CristianTM: Often when someone "STFW" for an answer to a question, StackExchange is the top result - which is great and speaks highly of StackExchange! I don't think it's a legitimate reason to disqualify a question from being posted here. BadSkillz' answer below it simple, useful, and may drive this very page to the top of everyone's search results on the topic -- AND it took his as long to produce it as it took you to post your comment. :-) – loneboat Feb 4 at 18:13
10  
'Self-signed' is orthogonal to 'trusted'. All certificates in my trust store are self-signed, what about yours? So the questions is simply "how do I tell my browser to trust a previously untrusted certificate?". – kubanczyk Feb 4 at 18:36

You need to import the root certificate into the trust store for the browser. Once the browser knows you trust this root certificate, all certificates signed by this will show up as trusted.

Note that this will only make the connection trusted for you, any others who don't have the root certificate installed will still receive an error.

share|improve this answer
3  
Note that, depending on how the certificate is configured and how you add it, this may allow your self-signed certificate to sign certificates for any domain. (This is not something you want.) – duskwuff Feb 4 at 19:48
1  
@duskwuff: Actually, it may be exactly what you want - if you want to set up your own Certificate authority, something many companies do for their internal network. Probably not the case here,though. – sleske Feb 5 at 9:07
3  
@duskwuff, that's exactly how an https proxy, such as BlueCoat, works. The organization buys the proxy, then installs the proxy's self-signed certificate in the trusted root store of each of the organization's computers. The proxy then MITMs all connections, including encrypted connections, to ensure that "bad things" aren't allowed to pass through the proxy. – John Deters Feb 5 at 20:06

Self-signed certificates are inherently not trusted by your browser because a certificate itself doesn't form any trust, the trust comes from being signed by a certificate that EVERYONE trusts. Your browser simply doesn't trust your self-signed certificate as if it were a root certificate. To make your browser accept your certificate, go into your browsers configurations and add the certificate as a root certificate.

The best way to get a self-signed certificate trusted is to go through a Key Ceremony, which is basically a big public event where all cryptographers and security experts gather together to witness a root CA generate their key-pair and declare themselves a root CA. Everything is recorded: video, who everyone is and what everyone does by lawyers. The private key is split into many different parts and stored separately in safes typically after signing a single certificate which is used as an intermediary to sign other certificates. You can read about the typical procedure if you'd like. Of course, you need to have state of the art security, both technological and physical, to do this and have anyone want to use or trust your root CA. After doing this your certificates may be included in browser distributions and then can be used by the general public to create trust chains of certificates.

share|improve this answer
2  
The "everyone trusts" portion of the statement above is the key failing of the entire system. In my opinion, the whole TLS infrastructure is built on a house of cards and no one wants to admit it. – Jon Trauntvein Feb 4 at 15:59
8  
@JonTrauntvein I agree with this (and others are willing to admit it) that there are some parts of TLS that are not good. The first being the certificate revocation system which basically does nothing as most browsers will ignore whether or not a certificate is revoked and secondly that some nation-state CAs don't follow the security guidelines above but are still packaged with all major browsers because of business political reasons. – Oasiscircle Feb 4 at 16:26

Actually, self-signed certificates can be secure, just not under the model we're using now.


Under the wide-spread CA (certificate authority) model that everyone uses currently, the purpose of the certificate being signed by a trusted CA is to provide authentication.

When we get a certificate, all we really see is 1's and 0's coming in from the jack in the wall; we have no idea where those 1's and 0's came from. However, because the certificate is signed by a CA - something that no one in the world other than that CA can do - and because we trust the CA to verify the identity of the certificate's owner, we trust that the certificate comes from who it claims to.

Of course, if the CA is compromised or doesn't correctly verify the owner, all bets are off.


However, there is another model, under which self-signed certificates do provide authenticity. It's called the notary model.

Essentially, rather than trusting a single CA, we distribute the trust to any number of notaries. These notaries scour the Internet in search of certificates, keeping a cache of all the certificates they've seen. When you visit a site for the first time and obtain the certificate, you ask a number of globally-distributed notaries what the last certificate they saw was. If they disagree with what you're seeing, you could be a part of a man-in-the-middle attack.

Under this model, self-signed certificates are perfectly secure, as long as we assume the server isn't immediately compromised before any notary can ever view its certificate.


The notary-model is still in its infancy, and its doubtful it will ever take over the CA model (actually, it doesn't have to - they can be used in tandem). The most promising project so far is Convergence.io, which has a plugin for Firefox.

share|improve this answer
2  
+1 for explaining a better model instead of just re-iterating the auth schema (known as "profit model") we currently allow ourselves to roll with. God forbid the CA's lose out for doing...pretty much nothing. (GlobalSign -> $250/yr DV -> ...ROFL) – dhaupin Feb 5 at 15:18
    
This is essentially a textbook distributed authentication algorithm wherein as long as a certain threshold of nodes trust a certificate, the network trusts it. There is a still a lot of ongoing research in this area and it is interesting if you are into that sort of thing. – Snowman Feb 6 at 15:23

Shorter answer.

A lot of answers here, but none seems to get straight to the point: Without a neutral and recognized third party—such as a certificate authority—verifying certificate ownership, a certificate is meaningless.

Longer answer.

To better understand, when doing something like creating an HTTPS connection you have the following chain:

  • A client web browser making the request to the server.
  • The remote web server sending data back to the client.
  • And an HTTPS certificate authorized by a neutral 3rd party that vouches that the server is who it is and the encryption is valid because of that.

A self-signed certificate is inherently untrusted because anyone can generate a self-signed certificate. Anyone including an entity that deliberately pretends to be something/someone they aren’t. With a self-signed certificate there is simply no trusted third party that has the basic human procedures set to simply state, “Okay, this domain has a certificate we issued them and thus you can trust them. We say they are in fact the domain the claim to be and not an imposter.”

And since anyone in the world can create a self-signed certificate on their own, it’s usage has inherent trust issues. What makes a certificate valid has very little to do with deep technology or encryption techniques but what makes it valid is a process centered around a neutral—and recognized—third party validating a usage procedure and browser makers adhering to a respect of those procedures.

At the end of the day an encryption key pair is an utterly meaningless pile of bits and bytes without the enforcement of the processes and procedures that surround them.

share|improve this answer

Any application must be given the list of "root certificates" to be trusted.

In case of a browser, there is a defined list that comes by default with any browser, but this list does not contain your certificate.

Imagine you don't need to actually give the list of certificates that you trust, then anyone would be able to setup a https website that an browser in the world would accept without warning of the security risk.

On the other hand, it would work out of the box is your CA certificate is itself signed by one of the default trusted certificates... but you have to pay.

There are enough answers as of how to add a CA certificate to the trusted list so I'll skip this part.

share|improve this answer

Self-signed certificates can't be trusted because anyone is able to craft one.

An attacker performing a MITM attack could easily replace any certificate by a self-signed one and impersonate any website you're browsing, even if you're using HTTPS.

That's why we are using trusted Certificate Authorities to ensure that certificates cannot be falsified.

share|improve this answer

We all need a little context.

There is a difference between "untrusted" and secure.

And "Trusted" does not necessarily imply Secure (or Authentic)

A self-signed certificate on an isolated network with only one server and one client is probably more secure than any "trusted" certificate.

And "trusted" implies ONLY that a Certificate Authority Certificate has been added to the "Trusted Certificate Store" for the client. If the Certificate Authority Certificate was added during a "phishing" session, then there is nothing Secure about the certificate.

I am not a fan that there are often hundreds of "Trusted" Certificate Authorities placed in the client by "others", but I also do not know of a better approach.

Certainly the Certificate Authorities need to perform better "vetting" process (in general) than they are doing now before they issue a Certificate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.