self signed certificate

Question

I read a lot of articles about self signed certificates and I'm not exactly sure if I'm getting near to what I want to actually achieve.

I'm trying to implement a self signed certificate so that the end users will not be seeing the "not secured warning" when they try to access the site (we are accessing the site through the company VPN). So, from what I understand is that the created certificate is needed to be imported to the machine's browsers for the end user not to see the "not secured warning".

Here's my dilemma, we've got hundreds of users that needed to use the site. Do we need to import the certificate on each machines browsers? Or is there any other way to do this?

Answer 1

If you have a company VPN, it's very likely that you will have a company CA. If this is true, you can create a Certificate Request, send to the team/group/person managing the company CA and have the certificate signed.

And with a company-wide CA, the CA certificate (and/or any intermediate certificate) will be trusted by all computers on the company, so you will not have a self-signed certificate (because the company CA signed it) and it will be trusted by all computers on the company (also because the company CA signed it).

If the company does not have an internal CA, it's a good idea to create one. If creating the internal CA isn't possible, then you will have to ask every user on the company to accept the self-signed certificate and install it on their computers.

Answer 2

I read a lot of articles about self signed certificates

Read some more.

If you want to go down the road of using your own certificates, then you should setup your own certificate authority. Although the term "self-signed certificate" is often abused to mean a certificated signed by a private CA, it actually refers to (as you might expect) a certificate signed by itself. Such a certificate is difficult to manage.

If you use a self-signed certificate, yes you need to deploy this to every client. If you use a private CA, the private CA cert will need to be deployed to every client.

But it's 2023. It's easier to get a LetsEnrypt certificate that will be accepted by every (patched in the last 5 years) client than mess around with your own CA.

Answer 3

What you are actually trying to do is not use a “self signed certificate” but do Public Key Infrastructure, or in other words, become your own Certificate Authority.

Since it’s only about your ow. Company, this is doable. But still something highly technical and difficult to do right.

The Root certificate for example (the only self signed one in the chain of done correctly) should be on air gaped machine and it’s private key should be in key management hardware. (Think smart card for the cheapest. Like the Nitrokey, only key and yubikey)

I don’t get the feeling your company is at the position where it could safely employ a self run PKI. And for that reason I would just get something like Let’s Encrypt Certificates.

As others have said as well, doing your own CA is asking for trouble.

Learn about it, study it. But be very conservative before considering even doing it yourself (for production).