0

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for SSL" it seems so, or am I wrong?

3

As long as all clients verify the fingerprint of the self-signed certificate (and you gave them the correct fingerprint through another way, like having a special application which has this fingerprint pinned, e.g. not the usual browser) it is secure.

Which effectively means: as long as the user is is using a normal browser, does not know the fingerprint of your self-signed certificate ore clicks through warnings anyway, it will not be secure, because the user is not able to distinguish your certificate from any other certificate of say a man-in-the-middle. This is like trusting any sheet of paper which claims to be an ID issued by a state.

2

In addition to @steffen's answer:

SSL offers a solution for a few problems:

  • Confidentiality: no problem. even with a self-signed/untrusted certificate your connection is encrypted.
  • Authenticity: This is where your problem lies. With a self signed certificate, you're not sure if you are talking to the real server, or to some bogus server.

So in your case, an attacker that's sniffing the connection won't seethe sensitive information your client is submitting, but if the attacker sets up an Man-in-the-Middle attack - she can trick your client to submit the information to her, and relay it to the real party. In this case, she captured the sensitive information which you wanted to protect in the first place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.