Importing a self-signed certificate into Windows via the Microsoft Management Console

Question

First, I apologize if I mix my terminology up a bit in this post, I'm new to SSL.

I've created a CA and used it to self-sign an SSL certificate for a server I connect to. Now I need to import the CA's certificate into the trusted certification authority store of the Windows machine I use to connect to the server so I can connect to the server via SSL and do certificate validation. Using the Microsoft Management Console (MMC), I imported the CA's certificate into the Trusted Root Certification Authorities folder. I can now connect to the server via SSL and validate the server's certificate.

My question is whether this approach poses a security risk. By allowing a user-created CA into the Trusted Root Certification Authorities folder, am I configuring my machine to trust a certificate authority created by any user, or just the CA I created? Is there another, less scary-sounding folder I can/should import the certificate into? My thinking is that what I've done is tell Windows to trust certificates that were issued/can be traced back to the CA I created (i.e. my machine won't trust other user-created CAs, even other CAs created by me), but I want to confirm this.

Answer 1

Yes, you're right, only certificates signed with the CA certificate/key pair you've created (or with intermediate CAs signed, in turn, with your CA) would be trusted. Whether owner of a CA certificate added to TRCA folder (i.e. a certificate authority) is an organization, a person or whatever (and how she or he's related to other certificate authorities) is out of scope of the PKI. Take care of your private key related to the certificate, and everything will be alright.