I have a question about Self Signed Certs that I couldn't find a direct answer to.

I have a site designed to be hosted on a client's server. Some of the information coming from a windows workstation to the server and back will need to be encrypted. To do this I was going to use a self signed certificate created by OpenSSL.

I plan to create root keys with OpenSSL and then also an intermediate set of keys to act as a middle-man.

My question is this: on the individual (Win10) workstations will they need OpenSSL to create a set of keys or will they simply need to add the intermediate's public key to their trusted keys? I want to keep setup as simple as possible for the end user.

  • 1
    "Simple as possible" may mean "use Lets Encrypt instead of self-signed certs."
    – gowenfawr
    Dec 12, 2019 at 16:41
  • You can add the root CA/intermediate certificate as a trusted root and the browsers should automatically accept it as valid. If you're using other applications then you may need to specify the CA in their configurations if they don't pull from the Windows certificate store.
    – user
    Dec 12, 2019 at 20:08
  • What is the point of the intermediate keys? Why not use Lets Encrypt? Is this a webserver or something else? If something else, what protocol are you using? Dec 13, 2019 at 3:07
  • @BenAveling the use of intermediate keys allows us to safely store the root keys. If our intermediate keys are compromised we can easily create a new set of intermediate keys much more easily than creating new root keys. Dec 13, 2019 at 14:49


You must log in to answer this question.

Browse other questions tagged .