When I create my own certificate and import this on all my devices ... is this as secure as buying a certificate?
When you purchase a certificate, the general process goes like:
- Generate a private key and a public key (also known as certificate)
- Generate a Certificate Signing Request (CSR) from the public key
- Send the CSR to a CA, pay some money, and get back a certificate signed by their private key
- Install the signed certificate, along with its private key, on your server
When you use a self-signed certificate, the general process goes like:
- Generate a private key and a public key (also known as certificate)
- Sign the certificate using your private key
- Install the signed certificate, along with its private key, on your server
Notice that in neither of these does a CA ever need to see your private key. The key generation is done by you, not by the CA. The CA simply takes the CSR, performs some degree of verification of the information in the certificate, and certifies that it is correct by signing the certificate with their private key and sending the resulting certificate back to you.
Hence, if you can live with the self-signed certificate warning when you browse to the web site and feel comfortable verifying yourself that you are receiving the correct certificate from your server, there is no significant security difference between a CA-signed certificate and a self-signed certificate.