First, I apologize if I mix my terminology up a bit in this post, I'm new to SSL.

I've created a CA and used it to self-sign an SSL certificate for a server I connect to. Now I need to import the CA's certificate into the trusted certification authority store of the Windows machine I use to connect to the server so I can connect to the server via SSL and do certificate validation. Using the Microsoft Management Console (MMC), I imported the CA's certificate into the Trusted Root Certification Authorities folder. I can now connect to the server via SSL and validate the server's certificate.

My question is whether this approach poses a security risk. By allowing a user-created CA into the Trusted Root Certification Authorities folder, am I configuring my machine to trust a certificate authority created by any user, or just the CA I created? Is there another, less scary-sounding folder I can/should import the certificate into? My thinking is that what I've done is tell Windows to trust certificates that were issued/can be traced back to the CA I created (i.e. my machine won't trust other user-created CAs, even other CAs created by me), but I want to confirm this.

  • Adding the CA into your (client’s) Trusted Root will mean it will trust a server certificate minted by that CA on any machine, not just the server you intended. It will not mean that the client will indiscriminately trust any user-created CA, you’re correct. Just be careful here— your machine is effectively trusting a less-trustworthy author and if someone manages to mint another cert with that CA and you trust it, that’s the issue. – Tara Hodges Jan 25 at 17:28
up vote 2 down vote accepted

Yes, you're right, only certificates signed with the CA certificate/key pair you've created (or with intermediate CAs signed, in turn, with your CA) would be trusted. Whether owner of a CA certificate added to TRCA folder (i.e. a certificate authority) is an organization, a person or whatever (and how she or he's related to other certificate authorities) is out of scope of the PKI. Take care of your private key related to the certificate, and everything will be alright.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.