Where I work, currently for internal sites, self signed certificates are being used. In Firefox, the info regarding the certificate are displayed:
site domain: example.com Owner: Site doesn't supply owner info verified by: company name
I am curious as to how vulnerable self signed certificates are to a man in the middle attack, such as SSL strip. The obvious vulnerability, I can think of is that users would be used to trusting the certificate so an SSL strip wouldn't produce any new warnings in Firefox (correct me if I'm wrong). Also in a man in the middle attack, is it possible for the attacker to display the same exact certificate to end-users (also verified by: the same company name)?