I wish to set up SSL/TLS for my site. How can I do this on my own without using a certificate authority. The site will be accessed only via certain machines so I can easily install the public certificates on their browsers.
If you can arrange for the correct certificates to be reliably recognized by clients, then all you need is to produce your own certificate "by yourself", traditionally as a self-signed certificate. Tutorials are easily found for that, e.g. with Linux tools or Windows IIS.
You might also want to run your own CA (e.g. with this software), and install the CA certificate in the client browsers -- this is extra initial complexity, but will make things simpler if you need to change some certificates later on (e.g. if the previously installed certificates expire).
I'm by no means a security or TLS/SSL expert, but I do know a few things:
- Implementing your own version of security protocols, hashing/encryption algorithms, etc. is generally a bad idea in production code. It's fun to do as a learning project though.
It's tempting to use client-side encryption when looking for a TLS or SSL, but this goes against best practices.
There are tools that help you make self-signed certificates, but I believe most browsers will show a warning to the user for this, which may scare some, if not most, users away.
I haven't tried it myself, but you may want to check out StartSSL. I can't guarantee it will work, and it may not support TLS, but if you want a free option, it's really the only non-self-signed one I have seen.
If someone comes along and says I'm wrong about what I wrote here, please listen to them! If not, I hope I could help you out.