Tag Info

Hot answers tagged

10

The purpose of the warning is that by using HTTPS, there is an expectation of proper security, but a self-signed or expired certificate has vulnerabilities that the user needs to be aware of. The "risk" is that one thinks they are properly secured, but they are not fully secured, as opposed to HTTP, where one knows there is no encryption at all. There ...


3

Without warnings for things like self-signed or expired certs, inappropriate cipher suite selections, and other bad HTTPS configurations, the presentation of a website's state of security to the user becomes binary - either you have HTTPS on the site, or you don't. This would hide a number of nuances which can significantly affect exactly how much the "S" in ...


2

First, let's talk about SSL (now called TLS by the way), which adds the 'S' at the end of HTTPS and is in charge of "securing the communication". The clue to answer this question is indeed to fully understand what we mean by "securing the communication". SSL, no matter if it is a self-signed certificate which is being used or one signed by a trusted CA, ...


1

Yes, your guessing is correct. OpenVPN has a built-in certificate management feature. This is the role of the Easy-RSA, I am guessing you already know that. The Easy-RSA is an RSA key management package based on OpenSSL. It allows you to build your own root CA and generate and manage the client's certificate/key pairs and the server certificate/key pair. ...


1

Not a full answer, but another thing to think about: with a system like that the easiest way for an attacker to gain access (ie the weakest link) is to steal the private keys to one of those client certs. Things to think about: Are the linux machines physically secure, or do they leave the building (ie laptops)? Do you have good policies for certificate ...


1

It may not be best practice because you're using a specific-purpose CA (in which case, authenticating your OpenVPN clients) for something else, but security-wise, as long as that CA is secure, your solution is fine. I would recommend however putting the private key of that CA certificate somewhere safe, like a smartcard, a completely offline computer or an ...



Only top voted, non community-wiki answers of a minimum length are eligible