4

I need to enable ssl between our internal servers. With "internal servers" I mean enable ssl between a jee application server and backend server(i.e. wildfly->elasticsearch, wildfly->mongo, wildfly->mysql and so on).

So, in order to enable ssl I need to create and use a certificate. My question is straightforward: Should these certificates be:

  • Self-signed?
  • Signed by an CA?

EDIT

By other hand, I don't understand an issue related with CA-signed certificates. When you are requesting a new certificate, providers are asking you for a domain. I'm able to figure out what's it for on web platforms, but what about internal CA-signed certificates... What's this domain for?

5
  • Do you have internal PKI in place? May 15, 2017 at 7:25
  • No, but I'm willing to anything. What's the better option?
    – Jordi
    May 15, 2017 at 7:29
  • 1
    Could the person who down-voted tis leave a comment explaining why ?
    – Stephane
    May 15, 2017 at 7:36
  • Stephane answered about your options much better than I could. Thanks @Stephane May 15, 2017 at 8:28
  • Depending on the application, TLS client certificate authentication could be used.
    – Paul
    Mar 9, 2022 at 0:17

2 Answers 2

4

It all depends on what you want to do.

First, unless you only have two machines and really need a cheap solution, avoid self-signed certificates. They are free and easy to generate but maintenance becomes exponentially more difficult as you add servers leading to improper behavior (blindly trusting certs permanently on every server, using certs with very long expiration, etc.).

Now, there are two other options: setting up you ow CA or using an external root.

Setting up your own CA is tricky: on one hand, it's very easy to do, on the other, it's pretty hard to do it right: there are plenty of very easy traps to fall for that will substantially decrease the security (and sometimes usability) of your PKI so it's a solution that need to be carefully planned, tested, implemented and maintained.

That said, having an internal CA (assuming it is properly setup and maintained) will give you plenty of very powerful tools for setting up internal security and it makes managing individual server certificates MUCH easier (in some situations, it can be completely automated).

The alternative is to use a commercial CA. If the following conditions are met, then it is a pretty good solution:

  • Your security needs falls in the standard offering (for instance, if you just want to secure web servers).
  • You plan to use exclusively public domains that you own (i.e. no "mycompany.local", no IP address, no "short" NetBIOS names).
  • You might need, at some point, to offer external access to some (or all) of your internal machines.

One final advise: avoid using a single wildcard certificates on multiple servers. That will make it harder to maintain your private keys securely and breaching a single server will leave your whole infrastructure in vulnerable.

0

Both self-signed and CA signed certificates provide encryption but A CA-signed certificate also provides authentication - a level of assurance that the site is what it reports to be, and not an impostor site.

This is the whole point of authentication. and as mentioned above at some point you might need to offer external access to some of your machines and you don't want authentication warning.

While it may seem like a good idea to try and save money and sign your own certificate, in the long run, you’re only hurting your server so better go with a Trusted CA-Signed Certificate instead. Setting up your internal CA might look a tedious task but in long run is the better option.

You can always go for a third party trusted Certificate Authority too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .