1

I have read multiple Q&A's on this topic from here and other SE sites. They all mention self-signed certs are not recommended due to MITM attacks. However, I haven't found anything with mention of creating your own CA and issuing certs for your servers.

My question expands on this topic, as I want to know if creating your own CA and issuing certs for your server reduces the possibility of a MITM attack. I would keep the CA private key locally to prevent anyone from generating additional certs. By being my own CA, I can verify in the certificate that it is indeed me who generated it and that the traffic is not "spoofed". I would copy the CA pub key to all my devices so the warning message wouldn't pop up anymore.

Although this brings up another question, can the attack create his own CA using my information entered, and generate a SSL key too to trick me? How does having a signed certificate differ at this point?

It seems to me that being your own CA or using a trusted CA does not differ much if the attacker has control of the mail server.

Improve this question
1
  • Can this be moved? Or do I have to repost?
    – exxboast7
    Sep 18, 2015 at 15:44

3 Answers 3

Reset to default
2

My understanding in regards to the first question is yes, it's safer to use a CA.

Regarding the second question, the attacker would have to create a key that had the same public key as your CA. This is hard, and gets harder with the size of your CA. Basically you only have to worry about a government or multinational corporation. The only difference between your private CA and Verisign's CA is in how securely the CA was generated & is stored (NOT insignificant) and the fact that Verisign is paying Firefox et al to preinstall their CA.

The best intro tutorial on SSL I've found has been available for many years and is still current: http://www.vanemery.com/Linux/Apache/apache-SSL.html

Improve this answer
1
  • This is a personal mail server to learn how to configure, manage, and support. The government will not find anything remotely entertaining or threatening. Sorry NSA.
    – exxboast7
    Sep 18, 2015 at 15:57
2

I guess this depends on whether you want to receive emails from other servers using SMTP over TLS.

A certificate issued by an untrusted CA is treated the same as a self-signed certificate by other SMTP servers. Depending on their policy, they may drop the connection or decide to transmit emails anyways.

If you just want to secure the connection between email clients and the server, then a personal CA is fine if you correctly installed the CA cert everywhere.

Improve this answer
0

For Personal Use, I recommend free yearly SSL's from StartSSL

@billc.cn you can use Self-Signed for TLS, just not mutual-tls.

Update, Startssl looks like they're having issues, I just renewed mine with https://buy.wosign.com/free and I feel dirty for it, I generated my own private key so I'm still safe from that aspect.

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

Improve this answer

You must log in to answer this question.