3

I have a system which is not connected to the public network. This system is used to open doors inside a building. It spans a open Wifi network where users can open a specific website and enter credentials to open the doors. A TLS certificate is used to secure the connection between the website and the browser. I have no control over endend user machines. Most probably they connect with Android devices (some also have iPhones or normal PCs). Now the old certificate expires and I'm thinking what the best future-proof solution could be:

  1. Certificate from Startcom CA: This is the existing solution we had. However several browsers don't trust this CA anymore. So I'd expect that several users won't get easy access to the website.
  2. Certificate from Let's Encrypt CA: This would require someone to retrieve the certificate, physically go to the hardware and change the certificate. This seems very error-prone. It quite some effort to do this and I expect that people forget this.
  3. Certificate from CAcert CA: This could be one possible solution. Here we would have to teach users how to import the CAcert root certificate and this would work.
  4. Buying a certificate from a CA: This is also a possible solution, but the organisation is quite small and can't effort to pay this amounts of money to get a certificate.
  5. Making a self-signed certificate: This is also doable, but I don't know how browsers will handle those kinds of certificates in the future.

So what is your recommendation? What kind of certificate would you recommend and what is the best in terms of user experience?

Improve this question
3
  • are user devices under your control or not? If they are, then you can go with private PKI solution that is cheap in deployment and import root cert to devices through MDM solution. Otherwise, the best solution would be to purchase SSL certificate from a non-expensive CA (not Let's Encrypt)provider who would give you a cert with 3yr validity at a reasonable cost.
    – Crypt32
    May 21, 2017 at 13:48
  • I have no control over end user machines.
    – qbi
    May 21, 2017 at 13:50
  • 1
    Then try to find non-expensive commercial CA provider (globally trusted). Something like RapidSSL or so. They can offer you a 3yr certificate that reduces cert management overhead.
    – Crypt32
    May 21, 2017 at 13:55

2 Answers 2

Reset to default
1

Self-signed certificates should not be used directly in TLS, but there is nothing wrong in building a private CA. You just provide the root certificate to all internal clients and all will work fine exactly like it would with paid certificates. The only difference is that well known root certificates are pre-loaded in browsers whereas you will have to distribute yours.

openssl contains all what is needed for a CA, but your could try easier interfaces like xca

Improve this answer
0

Buy a suitable certificate from a well known CA, one that is likely supported within the root stores of the devices that they are connecting. If the risk of loosing the private key from the certificate is not a concern then go with whoever offers the longest certificate lifetime.

I would not install/setup a self signed certificate. This offers little to no real protection. Yes the traffic would be encrypted, but it isn't truly authenticated. This means an attacker could Man-in-the-middle the traffic and spoof their own self signed certificate, making it pointless having one in the first place.

Improve this answer
2
  • 1
    Do you know that all root certificates are just self signed certificates?
    – Serge Ballesta
    May 25, 2017 at 16:02
  • Yes I do. But they are trusted with the browser and I think we all except that level of trust. If we didn't then we wouldn't be doing much on the internet. I'm purely talking about self signed server Certs returned over the network to the client as part of the SSL/TLS handshake. Plus he says above that he has no control over the end clients so your suggestion of a private PKI seems unlikely. But yeah a possibility. Thanks
    – ISMSDEV
    May 25, 2017 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.