Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm trying to wrap my head around the technical inner-workings of SSL and one of the last things I'm choking with is the concept of "root" SSL certificates (as opposed to "non-root"?!?).

  • When and how would an organization attempt to get a root cert as opposed to just a normal cert?
  • What are the benefits to using a root cert?
  • What are the use cases or application for a root cert?

I guess these questions are similar and are just different forms of why would I ever need a root SSL certificate, where would I get it from, and what would I do with it?

Thanks in advance.

share|improve this question

1 Answer

up vote 1 down vote accepted

A root SSL certificate is one that is used by a certification authority to sign other certificates -- either end-user certificates or chain certificates that are then used to sign end-user certificates. Their use case is to be distributed to users by secure channels so that they can be safely used to validate other certificates. For example, dozens of root certificates from certification authorities are included in all web browsers.

If you want one of your own, you can create it using openssl. You would then use it to set up your own certification authority, but since your root wouldn't be included in the user's web browser, you'd have to create some other secure delivery channel for it.

share|improve this answer
"you'd have to create some other secure delivery channel for it." But then the user would have to trust you as a CA! – curiousguy Jun 28 '12 at 16:30
Thanks @Mike Scott - so let me see if I understand you: (1) If I want to be the CA for my own private network, I obtain a root SSL from, say, a company like VeriSign, and that root gives me the ability to generate my own "normal" (end-user) certs or chained certs (which end up being end-user certs); and (2) since client browsers will not have my CA in their registries, I need to figure out a way to get them to trust me. Please correct me if any of this is wrong, and if you don't mind telling me, what are my options for setting up this "secure delivery channel" as you mention? Thanks (+1)! – zharvey Jun 28 '12 at 16:49
@zharvey: You don't need to involve a third party. Use a tool like openssl to create your own root certificate. A root certificate is nothing more than a cert without anyone else claiming they can vouch for you. Then you install this root cert into the user's certificate manager. – logicalscope Jun 28 '12 at 17:05
Your secure delivery could be done in lots of ways -- only you know your own circumstances and user base. Post out USB keys. Get your users to bring their laptops into your office. Set up a VPN connection and transfer them over http (but don't do it over http without authenticating the server). – Mike Scott Jun 28 '12 at 21:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.