Self signed cert is always looked down as a test-only certificate. But as per understating, using it for production is perfectly fine if used for the right reason. I am trying to provide some guidelines to my customers about that to use what. E.g.:
- Authentication: Not ok to use self-signed as the Brower will not trust the "self" issuer. So, for service-to-service or service-to-client authentication is not ok to use self-signed. Unless there is a pre thumbprint/CN whitelisting process before verifying. Lot of people do these, e.g. Azure where I upload the management cert public key, which is used to authenticate their API.
- Signing: No ok, as there is no trust with the issuer. Unless there is a pre thumbprint whitelisting process before verifying. Unless there is a pre thumbprint/CN whitelisting process before verifying.
- Encryption: Perfectly OK to use self-signed as there no chain trust required. In case of an attack, the MIM cert will simply not decrypt, no other impact.
I would like some thoughts/recommendations/guidelines from the community to ensure my recommendations are in the right direction.