3

I wish to set up SSL/TLS for my site. How can I do this on my own without using a certificate authority. The site will be accessed only via certain machines so I can easily install the public certificates on their browsers.

3
  • 3
    By "implement TLS", do you mean "put TLS into effect", or do you mean "write your own TLS handling"? In most circumstances, only the first of those options is a good idea. Jun 1, 2014 at 2:57
  • yes i just want to put it into effect .. using the existing validated algorithms without having to rely on an external CA
    – Eels
    Jun 1, 2014 at 14:19
  • Why bother? Let's Encrypt using DNS validation makes using real certificates for non-publicly accessible internal or firewalled sites a no-brainer. And it saves you the bother of having to install certificates on the clients. Mar 2, 2020 at 11:08

2 Answers 2

5

If you can arrange for the correct certificates to be reliably recognized by clients, then all you need is to produce your own certificate "by yourself", traditionally as a self-signed certificate. Tutorials are easily found for that, e.g. with Linux tools or Windows IIS.

You might also want to run your own CA (e.g. with this software), and install the CA certificate in the client browsers -- this is extra initial complexity, but will make things simpler if you need to change some certificates later on (e.g. if the previously installed certificates expire).

1
  • thanks a ton for this .. this is what I was looking for .. I am midway trying to implement this on my local machine.. And at this point I can't seem to figure out how I can use this for a hosted site. I have a host provider where I have to use the cpanel to make any changes.. and I am not sure if I'll be able to do this .. I guess I'll know better once I try it out .. I'll get back here once I do that ..
    – Eels
    Jun 1, 2014 at 14:25
2

I'm by no means a security or TLS/SSL expert, but I do know a few things:

  1. Implementing your own version of security protocols, hashing/encryption algorithms, etc. is generally a bad idea in production code. It's fun to do as a learning project though.
  2. It's tempting to use client-side encryption when looking for a TLS or SSL, but this goes against best practices.

  3. There are tools that help you make self-signed certificates, but I believe most browsers will show a warning to the user for this, which may scare some, if not most, users away.

I haven't tried it myself, but you may want to check out StartSSL. I can't guarantee it will work, and it may not support TLS, but if you want a free option, it's really the only non-self-signed one I have seen.

If someone comes along and says I'm wrong about what I wrote here, please listen to them! If not, I hope I could help you out.

Good Luck!

6
  • 2
    The OP probably doesn't want to do something insane like write a TLS implementation, just use TLS with a self-signed cert, which isn't insane. Yes, StartSSL certificates work with TLS. I'm not sure if it's possible for a cert not to. Jun 1, 2014 at 1:15
  • thanks .. I am not trying to create my own algorithms .. just trying to implement the already existing ones .. i know the browser will show warning but since i can control all the machines that will access the site .. i can simply install the public certificates on them.. :)
    – Eels
    Jun 1, 2014 at 14:27
  • StartCom CA is closed since Jan. 1st, 2018, it doesn't issue any new certificate from StartCom name roots. Mar 2, 2020 at 15:04
  • The title and text of the question were misleading. I have updated the title to "How to set up TLS without a certificate authority on a site for internal use" Mar 2, 2020 at 15:04
  • 1
    @MattNordhoff: it's certainly possible for an X.509/PKIX cert to have Extended Key Usage (EKU) that doesn't include the SSL/TLS values (serverAuth, clientAuth) or AnyEKU; common examples are those for S/MIME email and for code-signing (Windows, MacOS, iOS, Java, android at least) and for PDF-signing. There are many other things that use X.509 that aren't as well known and visible. There are also PKIX certs that are used with TLS that aren't server or client certs, namely those for CAs and OCSP responders. Mar 3, 2020 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.