I need to enable ssl between our internal servers. With "internal servers" I mean enable ssl between a jee application server and backend server(i.e. wildfly->elasticsearch, wildfly->mongo, wildfly->mysql and so on).

So, in order to enable ssl I need to create and use a certificate. My question is straightforward: Should these certificates be:

  • Self-signed?
  • Signed by an CA?


By other hand, I don't understand an issue related with CA-signed certificates. When you are requesting a new certificate, providers are asking you for a domain. I'm able to figure out what's it for on web platforms, but what about internal CA-signed certificates... What's this domain for?

  • Do you have internal PKI in place? – Marko Vodopija May 15 '17 at 7:25
  • No, but I'm willing to anything. What's the better option? – Jordi May 15 '17 at 7:29
  • 1
    Could the person who down-voted tis leave a comment explaining why ? – Stephane May 15 '17 at 7:36
  • Stephane answered about your options much better than I could. Thanks @Stephane – Marko Vodopija May 15 '17 at 8:28

It all depends on what you want to do.

First, unless you only have two machines and really need a cheap solution, avoid self-signed certificates. They are free and easy to generate but maintenance becomes exponentially more difficult as you add servers leading to improper behavior (blindly trusting certs permanently on every server, using certs with very long expiration, etc.).

Now, there are two other options: setting up you ow CA or using an external root.

Setting up your own CA is tricky: on one hand, it's very easy to do, on the other, it's pretty hard to do it right: there are plenty of very easy traps to fall for that will substantially decrease the security (and sometimes usability) of your PKI so it's a solution that need to be carefully planned, tested, implemented and maintained.

That said, having an internal CA (assuming it is properly setup and maintained) will give you plenty of very powerful tools for setting up internal security and it makes managing individual server certificates MUCH easier (in some situations, it can be completely automated).

The alternative is to use a commercial CA. If the following conditions are met, then it is a pretty good solution:

  • Your security needs falls in the standard offering (for instance, if you just want to secure web servers).
  • You plan to use exclusively public domains that you own (i.e. no "mycompany.local", no IP address, no "short" NetBIOS names).
  • You might need, at some point, to offer external access to some (or all) of your internal machines.

One final advise: avoid using a single wildcard certificates on multiple servers. That will make it harder to maintain your private keys securely and breaching a single server will leave your whole infrastructure in vulnerable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.