Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Where I work, currently for internal sites, self signed certificates are being used. In Firefox, the info regarding the certificate are displayed: site domain: xxx.com Owner: Site doesn't supply owner info verified by: company name

I am curious as to how vulnerable self signed certificates are to a man in the middle attack, such as SSL strip. The obvious vulnerability, I can think of is that users would be used to trusting the certificate so an SSl strip wouldn't produce any new warnings in firefox (correct me if I'm wrong). Also in a man in the middle attack, is it possible for the attacker to display the same exact certificate to end-users (also verified by: the same company name)?

share|improve this question
add comment

3 Answers

up vote 8 down vote accepted

Instead of using self-signed certificates for internal sites, I suggest you set up an internal CA and use it to sign certificate requests. You can import your CA's certificate into each browser used internally (either manually or via automated deployment mechanisms) and this should be as good security-wise as using certificates issued by a major CA -- as long as you take proper measures to secure the system used for signing certificate requests.

This is a much better solution than self-signed certificates and, depending on your environment, your domain controller may already offer CA services (MS Active Directory, FreeIPA, etc).

share|improve this answer
add comment

A self-signed certificate is a certificate which is not verifiable by virtue of it being signed by a trusted CA. So you have to be able to check that this is the "right" certificate by some other mean. Otherwise, an attacker could redirect your connection to a fake server (sporting another self-signed certificate), and from there run a man-in-the-middle attack.

If you can make sure once that the self-signed certificate is correct, then you can install it in the "trusted store" of your browser, which will ensure security for all subsequent connections(*). To a large extent, this mimics the usual SSH security model, which Unix sysadmins are quite happy with. One possible way, for the first connection, to check that the certificate sent by the server is the right one, is to ask your browser to display the certificate "thumbprint" (a hash value computed over the whole certificate) and phone the expected server sysadmin for comparison with the reference thumbprint.

(*) Note the tricky point: security is ensured as long as you never accept an unverified self-signed certificate -- pay heed to the browser warnings !

share|improve this answer
add comment

As long as you add your self signed certificate to the browsers trusted store, a self signed certificate is for all intents and purposes the exact same as a certificate signed by a certificate authority.

share|improve this answer
    
ahh that makes sense, thank you –  marcwho Apr 9 '13 at 13:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.