What are the implications of adding a self signed certificate to the Windows Trusted Root Certification Authorities store?

Question

I'm a budding website developer, so please bear with my ignorance.

Say I had to encrypt my website with HTTPS and I got sick of having to click "Continue" every time a warning came up about an untrusted certificate. I used this method to install my site's certificate.

Say the certificate I signed is issued by "xyz." Since the store is called "Trusted Root Certification Authorities," I assume that it trusts "xyz" as a certification authority. When my certificate is added to the store, does that mean that any certificate issued by "xyz" now is automatically trusted?

Or does installing an SSL certificate for a domain to "Trusted Root Certification Authorities" only make that one domain trusted?

The point is I want to ignore the warnings for my website in particular but do not want to ignore the warnings for any other website.

EDIT: I probably should elucidate on the exact procedure I used to create the certificate. The website is deployed on a Ubuntu 10.04 server with the default OpenSSL and Apache configurations. To create the certificate and key file, I simply used

# make-ssl-cert generate-default-snakeoil –force-overwrite

and left /etc/apache2/sites-available/default-ssl alone because the make-ssl-cert command wrote the two files to the same paths that the Apache configuration files point to. So I didn't even set up a certificate authority to generate my website's certificate from.

Does this change the scenario at all? What's the difference between installing a certificate created without a certificate authority as trusted root on a client, and installing a certificate created with one?

EDIT 2: Okay, it would be better if I were to narrow the question down as much as I could: Is it safe to ask others to install my certificate as trusted root if I secure the certificate for my website and make sure it never escapes? Will attackers ever be able to take advantage of my self signed certificate and target those who have installed it to their trusted certificate store?

Answer 1

When you install a CA certificate as "trusted root" then this means that your applications will trust whatever certificates are issued by this CA certificate. This is not, by default, restricted to a specific domain. X.509, the standard for certificates, includes a way to specify that a given CA is for issuing certificates only in a specific "area", e.g. for servers in a domain (that's the Name Constraints extension, see section 4.2.1.10), but it is poorly supported, or not supported at all, by existing implementations. So I would recommend against relying on this feature.

So the basic rule is that when you install a new trusted root, you are entrusting the owner of the private key with your browsing security. If you are the owner (that's your self-signed certificate, which you generated yourself), then it is up to you to keep the CA key safe. As long as nobody else gets a copy of the private key, then there is no problem. This leads to the following method:

1. Create a new key pair and a self-signed certificate.
2. Use that newly created CA to issue a certificate for your server.
3. Import the CA certificate as trusted root.
4. Forget the CA private key (destroy the key; ideally, the key is in a file which you put on a RAM-backed filesystem, making suppression reasonably complete).

and you are done. If the private key is no more, it is, in particular, out of reach of malevolent adversaries.

An alternate method is to use a self-signed certificate for the server itself, and instruct your Web browser to nonetheless trust that certificate for your site only. If your browser can do that, then no need to fiddle with root CA. Firefox can do that; they call it a security exception.

Answer 2

In case when someone is intercepting your users' traffic, that person can pull a man-in-the-middle attack and present your users with their own certificate to install instead of yours. In this case they will be able to decrypt all data passing between clients and the server.

Other than this, no consequences.