Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to make my Synology NAS accessible over the internet. When I create my own certificate and import this on all my devices (PC, Laptop, Smartphone, Tablet, etc.) is this as secure as buying a certificate?
If not, what is the most secure thing I can achieve without spending any extra money?
The purpose of a public certificate infrastructure is to create a chain of trust between entities that don't trust each other directly. You pay the certificate authorities because other people trust them to issue certificates to trustworthy entities only.
Assuming you trust yourself (or whoever issued the certificate), self-signed certificates are no less secure than those signed by a public CA.
Similar and possibly relevant question: Is a self-signed SSL certificate much better than nothing?
Self-signed certificates are perfectly secure, but as a general statement remember that your client's browsers will not trust your website because your public key isn't in their keystore. In this case, the certificate itself acts as the public key, and the client assumes that if the server that handed out the certificate can decrypt a message with it's private key, it must be the genuine owner. In this regard, self-signed certificates are every bit as secure as those signed by a CA assuming you trust the owner of the website, which I'm sure you do.
When done properly, self-signed certificates are as secure as certificates issued by commercial certificate authorities. However, consider that you would need to install your own root certificate on each device. Unless you are the only user or have very obedient users who are willing to put up with the hassle of installing the root certificate, you will likely see decreased security in practice, as most users will just dismiss the SSL certificate warnings or disable certificate validation altogether instead. (For a Windows client, for example, the steps to install a root certificate system wide are non-trivial. Beyond that, you would also have to install it once per Firefox profile if you use Firefox.)
In that context, you may find that it is advantageous to spend just a few dollars a year to get a commercial certificate. You could even get a free one. With basic (single hostname, validation of domain control) certificates being so cheap, I don't recommend acting as your own certificate authority for most circumstances.
When I create my own certificate and import this on all my devices ... is this as secure as buying a certificate?
When you purchase a certificate, the general process goes like:
When you use a self-signed certificate, the general process goes like:
Notice that in neither of these does a CA ever need to see your private key. The key generation is done by you, not by the CA. The CA simply takes the CSR, performs some degree of verification of the information in the certificate, and certifies that it is correct by signing the certificate with their private key and sending the resulting certificate back to you.
Hence, if you can live with the self-signed certificate warning when you browse to the web site and feel comfortable verifying yourself that you are receiving the correct certificate from your server, there is no significant security difference between a CA-signed certificate and a self-signed certificate.
