I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed cert.
I have three questions.
The document shows two ways: (1A) Generating your own self-signed cert. and (1B) Generating your own cert/CA and then using the CA to sign your cert.
I don't understand what the difference between the two is. What is the point of generating your own CA if none of the browsers trusts it (unlike certs signed by Verisign)? Is (1B) used to prevent MITM attacks? If so, should I use (1B) over (1A)?
Other than managing/revoking multiple certificates (if I use them), a self-signed CA seems pointless?
I noticed that the doc uses des3 cipher. Would it be possible to use aes-256 cipher instead unless there is a good reason to use des3? (Also how do I do this?)
This thread made a distinction between using 2048 bit keys and 256 bit keys. I understand what the answer is saying to some degree (that the public (2048 bit) keys are used to encrypt the symmetric (256 bit) keys in order to exchange keys between server and client). But I do not understand how this is applied in the context of the doc. In the doc, I see this line:
openssl genrsa -des3 -out server.key 4096
Does this line mean that it's generating a symmetric key (des3), and then generating a public key (RSA 4096 bit)?