SSL self-signed certificates in development vs acquired cert in production?

Question

I am a developer, I have created self-signed certificates before for my work.

This time, I am involved up until going live with the whole app (usually there was someone else in charge of this).

Questions:

• Is it ok to use self-signed certificates for development, and then use the acquired one for production only?
• Does using self-signed certificates imply that in development, the clients need to add my CA to their list?
• When we go live, using the actual acquired certificate, will there be any change in clients?

I am ok with just links to documentation, I did some search but couldn't find specific answers for the whole workflow.

Answer 1

Is it ok to use self-signed certificates for development, and then use the acquired one for production only?

Yes, that is the way almost every one does. You don't have to pay a certification authority to certify that you are talking to your own server. Self sign it until production, buy a real certificate later.

Does using self-signed certificates imply that in development, the clients need to add my CA to their list?

Yes, that's correct. Or that or the dreaded "The server you are connecting to can be trying to stab you" will display on their browsers.

When we go live, using the actual acquired certificate, will there be any change in clients?

Nothing will change. Unless you have employed Key Pinning with a long max-age, you put a valid certificate on your server and forget about it until it's time to renew it. Your clients will never see any difference.

But if you are using Key Pinning, you must use at least two certificates. If you pin the wrong certificate, it expires, gets compromised or lost, your clients will not be able to connect until the pinning expires. Having a backup pin (the second, valid certificate) will ensure you can pin another certificate and fix any mess.