1

I have an ESXi server that is using a self-signed certificate, and the browser gives a warning that SSL certificate cannot be trusted.

I want to put that cert into the Trusted Root Certification Authorities store. Will that get rid of the warning message?

Also is it possible to create identical self-signed certificates? For example, an attacker realizes I have self-signed certificates in the Trusted Root Certification Authorities store and they make (Self-sign) cert with the same parameters. Would they be able to perform a MiTM attack?

2 Answers 2

1

The process for making a self signed certificate includes getting a randomly generated key to use for the certificate. Your operating system provides tools to create cryptographically secure random numbers to use for that purpose. So every certificate you generate will have a unique key, and nobody can (easily) create the same certificate.

Part of what makes public key cryptography work is that you never reveal the key to anyone. The ESXi server will prove to your web browser that it knows the key, but never tell you what the key is. So nobody can copy your certificate and make a new one that way. They would need to break into the server and steal the key from there, at which them point copying your self signed certificate is the least of your worries.

Adding the self signed certificate to your trusted root store will likely get rid of the warning, as long as it's an otherwise valid certificate that follows all of the rules for host names and validity durations. It doesn't create any new security concerns, and is much better than just accepting the certificate warning, because if you routinely just click ok to that warning, someone else could pretend to be your ESXi server with any self signed certificate, and you wouldn't notice unless you actually examined the certificate carefully each time.

1

Will that get rid of the warning message?

Yes

Simplistically 'certificate' is just signed public key from generated pair of asymmetric keys. Certificate must be signed with private key of some trusted authority named 'Certificate Authority'. CA may be public or private (yours). You may create your own CA with openssl, generate certificate and sign it by your own CA.

To check validity and trust of your certificate program or operating system needs certificate (public key) by what your certificate is signed - CA certificate.

To trust CA certificate itself it must be somehow marked as 'trusted' for program or OS.

Putting CA certificate into the 'Trusted Root Certification Authorities' store literally means that you trust this CA cert and it become trusted by your OS.

Self-signed certificate is signed with its own private key, instead of CA's private key. So to check self-signed certificate you have to trust the self-signed certificate itself (its public key) by putting it into 'Trusted Root Certification Authorities'.

Also is it possible to create identical self-signed certificates?

No

Prime numbers for keys (if RSA used) are randomly chosen from very large number space and the size of this space is proportional to the key's length (thousands of bits as for now, 2key_length) and chance to choose the same numbers is very low.

What are the chances to generate the same ssh key?

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .