This question already has an answer here:

My company wants to use client certificates for clients on production. We have a HTTPS certificate. As I understand we need a CA root certificate to create client certificates. Question: is it OK if I just create this CA root using makecert, install on web server only, and use it to create client certificates?

marked as duplicate by StackzOfZtuff, Xander, Neil Smithline, Stephane, Deer Hunter Nov 17 '15 at 8:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • define what you mean by "is it OK?" – schroeder Nov 13 '15 at 15:57

CA means Certifying Authority. You can't be a CA to yourself (known as self signed). There are separate entities that are considered valid CA, like VeriSign or Symantec. Certificates obtained from these CA will not raise any issues when you're using the webserver. Else, you'll see a message that the certificate can't be trusted or is not from a trusted source.

makecert will create self signed certificates only. Since it's for production, I would prefer to get certificates from a valid CA only.

  • I don't understand. To create production client certificate I need CA or certificate? Is it the same as https certficate which I have or I need to buy new one? – mtkachenko Nov 13 '15 at 18:08
  • You need to obtain the certificates from a CA. You need to pay for the certificate. Note that you can't create a CA. – Balaji Kundalam Nov 13 '15 at 18:16
  • So I have https certificate but it can't be used to create client certificates. I need to buy a new one especially for creating client certificates. Correct? – mtkachenko Nov 13 '15 at 18:30
  • @oblomov86 no, you obtain client certificates the same way you obtain a server certificate. – guntbert Nov 14 '15 at 14:13
  • 1
    -1 of course you can create your own CA. – guntbert Nov 14 '15 at 14:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.