1

I have just deployed a Turnkey appliance which comes configured with a self signed certificate.

This is a server that only I will be using, so I don't want to pay for a certificate.

If I add this certificate to my web browser's Trusted Root Certification Authorities store:

Will it protect from a MITM attack if the attacker does not have the private key to reproduce the certificate?

What will happen when the certificate expires?

1 Answer 1

3

The only difference between a self-signed cert and one issued by a CA is exactly that, the self signed cert is not issued by a CA. If you trust yourself, then you can trust your "self-signed cert". It will protect you from MITM as long as you have SSL/TLS configured correctly on your server (ie: you do not accept null ciphers). When it expires, your browser will issue the same warning that you would get if a public CA signed cert expired.

2
  • Just disable the null cipher suite in apache?
    – user41813
    Mar 11, 2014 at 16:24
  • 1
    Not just that. There are many questions on TLS setup, have a search for it. I was just giving an example
    – CtrlDot
    Mar 11, 2014 at 16:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .