Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL certificate to accomplish that (I thought it's all something that automaticaly enabled for each website, don't ask me why).

Then I went over to my hosting provider website and found out about the prices of these certificates... But I don't need something like that for my blog... I also found out that certificates can be self-signed, or obtained for free from certain certificate authorities.

What I'm wondering is - how should I approach this?
Since I'm the only one that's logging in there - should I generate my own certificate? Or get a free one from some CA? If yes - which CA? cacert maybe? Will it all stay transparent this way, or will I start getting warnings about custom and unverified certificate? Can I trust a solution like this?

Does it even make sense to try and do something like this if I'm using shared hosting? I mean, from what I've read - this certificate would have to be installed on the server, and not just put somewhere in my hosting folder (as I thought it would work).. and the hosting provider won't do this for free I guess because it's kinda not in their interest (in any case I asked them, and am waiting for reply)...

Should I just drop it, or is there anything I can do on my own?

share|improve this question
1  
Not quite duplicates, since this is a specific situation, but check out these questions for some more info: security.stackexchange.com/q/90/33 and security.stackexchange.com/q/146/33 –  AviD Dec 15 '10 at 19:53

5 Answers 5

up vote 31 down vote accepted

I like using StartCom for a free certificate. It's recognized in most major browsers and is better than using a self-signed certificate (No error prompts for users).

share|improve this answer
    
+1 -- the only browser I have come across that did not support the certs from StartCom is the one on Android, though that appears to be fixed these days as well. –  Michael Trausch Dec 16 '10 at 20:55
    
I also like (and use) StartCom. The Sony Playstation3 web browser is the only browser I've come across that doesn't trust it. –  MattBianco Aug 15 '12 at 8:02
1  
Java SE 6.0 doesn't trust StartCom certs too, I haven't checked 7.0 but I don't think anything changed. –  Hubert Kario Nov 3 '12 at 10:37
    
+1 I use StartCom for my logins. Even in a small-business environment. –  lynks Apr 22 '13 at 12:04
1  
While I like the idea of free SSL certificates, we do need to keep in mind the limitations of these very-cheap validation protocols. They only validate control of the site at the time that the certificate is generated; they do not check with other CAs for previously issued certificates. A MITM attacker can act as your website while generating a new certificate they have a key for because the validator obviously won't use HTTPS to confirm ownership. If the attacker can sit in front of the CA, email and DNS verification can also be subverted. –  LateralFractal Oct 22 '13 at 13:19

Shared hosting providers will have to install the certificate for you. Although you can create self-signed certificate, I have no idea if a shared providers will install one. They provide the same level of security, but will cause browsers to show a warning since they're not registered with a certificate authority.

If you have a VPS or a managed VPS, you can install a self-signed cert yourself. You could call your provider, or see if they'll accept a cheaper 3rd party certificate (goDaddy's are like $12).

If you're only using this login for administrative purposes (adding content to a blog or something) and you have SSH access to your provider, you could tunnel over SSH into the host and access the site from localhost, preventing the credentials from being transmitted over the internet.

share|improve this answer
3  
They provide the same level of security this is not accurate. It does provide the same level of protection against interception, but thats not the same thing. Specifically, selfsigned certs do not provide authentication (in the general case). See my answer here. –  AviD Dec 15 '10 at 19:52
4  
Thats an interesting point about self signed certificates and authentication. However in this case it sounds like pootzko is looking for a cert for his own login, in that case if creates a CA and an self-signed certificate and imports the root into his browser then he has that authentication. I'd agree for most external (Internet) apps that self-signed certs aren't a good option but for internal/personal applications I think they can provide as much as a purchased one. –  Rоry McCune Dec 15 '10 at 21:39
    
@Rory, that's true, probably. Thats why I didnt put that as a real answer (or downvote), but I felt the clarification should be in place for the next viewer... –  AviD Dec 15 '10 at 22:19

One thing you'll need to look into is whether you'll be able to have SSL on your shared hosting at all. If you've not got a unique IP address (eg with a VPS plan) then getting SSL working will be tricky.

Traditionally SSL is handled on a per-ip basis not per hostname, so where you have named based virtual hosting (most lower end web hosting plans) it's not possible to assign unique certs to each site. That is possible now with SNI but you'd need to check that your hosting company and browsers support it.

share|improve this answer
    
The problem with SNI is that WinXp and some mobile device browsers don't support it, anyway if OP only wants SSL for its backoffice he should go ahead if the shared hosting provider supports it. –  Shadok May 13 '11 at 8:57

One of the only reasons you buy SSL certificates (and don't buy rsa/dsa keys) is for the trust relationships.

If you can securely import a self-signed SSL cert into your browser and install the SSL cert on your web server, there is no reason to involve anyone else.

See AviD's comprehensive description of SSL for more information. What SSL provides:

* It encrypts the channel
* It applies integrity checking
* It provides authentication

You can get all 3 of those, if you use self-signed Certs, but you have to securely install the cert on your end-points to get the third feature.

share|improve this answer

CACert, as you've mentioned, is good for SSL certificates, and is sometimes a little bit more useful than using self-signed certificates, because there's quite a few people now who do have the CACert CA certificate installed in their browsers, and they're quite big on building up a physical web of trust.

share|improve this answer

protected by Community Oct 23 '13 at 3:18

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.