Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I know that if I use self-signed cert, browsers will warn about it to the user, but I want to know that from security viewpoint is self-signed cert as secure as certificate authority(CA)?

share|improve this question
1  
What is the specific usage scenario? Do the users know the site, the webmaster? – curiousguy May 31 '12 at 9:40
It is not for internal usage. Suppose we have a commercial website. @curiousguy – Sheriff Jun 1 '12 at 9:55
Customers certainly expect a regular "verifiable" certificate. Self-signed is not an option. – curiousguy Jun 1 '12 at 13:19
Given the way modern browsers kick up a fuss over certification issues. A self-signed certificate will pretty much block most users from your site. Certain versions of chrome will actually not let you visit the site. – lynks Dec 4 '12 at 15:30

6 Answers

up vote 8 down vote accepted

Features

A self-signed certificate is capable of having the same security features (encryption, extended validation, permitted usage) as a certificate issued from a leading issuer such as VeriSign or GeoTrust. These options need to be set when the certificate is created.

Trust

However the purpose and the advantage of Public Key Infrastructure (PKI) (such as Internal Certificate Authority used inside an enterprise, VeriSign/Symantec, GeoTrust, and many more) is that there is an existing trust relationship between the client and the certificate issuer (e.g. VeriSign). The client (people and browser) trusts that the issuer has checked you out and has verified you are who you say you are. Certificate issuers have stringent security practises that they have to maintain. This type of relationship is not replicated with a self-signed certificate.

You can install a self-signed certificate into a browser (needs to be done for each browser) to make it recognise the certificate as trusted.

If you do not do this step the user has no way of knowing the certificate has changed unless they manually inspect the certificate. This could be dangerous because someone could intercept the transmission (man-in-the-middle) and the user would not know the certificate/host was the wrong one.

Summary

When looking at functionality alone, a sign-signed certificate offers neither more or less security then one issued from a leading certificate authority.

Websites are for users, and a certificate trust is important so the user knows your website is who it says it is.

My personal opinion is that the trust and ease of deployment gained by using a public issuing authority is very important for a public web site, especially if you don’t have an existing close relationship with the people visiting it.

A self-signed certificate may be suitable for limited internal development / testing.

An internal Certificate Authority for use is a good solution for enterprises who use certificates internally and have an expertise in PKI.

Hope that helps

share|improve this answer
thanks. Different answers have been given you say that from security standpoint it does not differ, but the others (@Mike Scott and @olvrlrnz ,..) mentioned it is not. I'm in the dark now! – Sheriff May 31 '12 at 12:35
1  
They are both correct in part, but have failed to mention that if you install the certificate in the browser, the client is aware that the certificate is different. The problem is there is no existing trust with a self-signed certificate. The user has no real way of telling if they are connecting to or installing the right certificate is trust does not exist. – Bernie White May 31 '12 at 19:20
up vote 3 down vote

It's not secure, because it makes you vulnerable to a redirection or man-in-the-middle attack. Any attacker can create a self-signed certificate for your domain, and your users won't be able to tell that they've received the wrong one if they're taken to the attacker's site instead of yours.

share|improve this answer
You said: Any attacker can create a self-signed cert for your domain. Are you sure about this? Do you have any solid proof? – Sheriff May 31 '12 at 12:31
6  
Yep, go create one. OpenSSL's free and you can experiment with spoofing your own site. – Fiasco Labs May 31 '12 at 14:57
up vote 2 down vote

As you already said, the browser will issue a warning to the user. This makes it possible to man-in-the-middle the connection. Certificates are about trust and your self-signed certificate lacks the trust-chain you normally get with a CA-signed cert. Consider this: if the client is going through my router to connect to your website, I can intercept the communication, generate a cert on the fly (for the client) and talk to your server using your cert. It would still look the same for the client but on my router I have the unencrypted traffic.

share|improve this answer
up vote 1 down vote

The funny part of all this is that in all the hosting companies I have worked for I have NEVER HEARD OF Verisign, Comodo, or any other Certificate Authority calling to check the information provided by their customer is true. They check that the credit card charges properly, and might check that the billing address matches what the customer said TO BILL THE CREDIT CARD, but NOT to issue a certificate. So while the 'trusted relationship' is implied, it is rarely ACTUALLY THERE! Yep, generating your own cert is ok for internal stuff, but for public facing stuff, where customers will be buying, you need to use a public certificate authority issued certificate. Customers don't understand any of this, nor should they have to, but they are trusting that the Verisign company is trustable (even though they don't check certs before issueing them, they're made by a computer..not a human). Hope this helps.

share|improve this answer
+1 thanks, so you mean hosting companies that you have worked for don't offer Verisign, but they charge customers for the verisign cost. Is that what you say? – Sheriff Jun 1 '12 at 9:53
I have been called several times. And my director was called for EV. I have also been asked to supply an official letter from domain owners when the domain I was issuing was not directly owned by my department. My experience is they do check. – Bernie White Jun 2 '12 at 1:07
up vote 0 down vote

As trust in PKI is somehow broken (comodo etc...), CA signed certificates show give you no popups :)

For internal usage there's no need for CA signed certs.

share|improve this answer
For internal usage, you should make your own CA. – curiousguy May 31 '12 at 9:41
up vote 0 down vote

It is the CA's role to deliver certificates to the various users. If the CA is compromised, any certificate from that CA will be revoked, i.e. it will be invalidated.

share|improve this answer
1  
1. Ceci est un site international, donc en pratique anglophone. 2. Good point about revocation being easier to manage through institutional channels, but considering how rarely revocation works as intended, I don't see it as a very strong argument. – Gilles Jun 1 '12 at 17:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.