Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

SSL certificates are pretty expensive for individuals, especially if you need to secure different subdomains. I am considering using self-signed certificates, as my primary focus is to secure the connection, and not to authenticate myself.

However, several browsers display nasty warnings when encountering such a certificate. Would you discourage the use of self-signed certificates (for example for small web application or the admin page of a small website) ? Or is it OK in some cases ?

share|improve this question
1  
might be better to use free SSL certificate startssl.com/?app=1 –  Adam Jul 21 '10 at 19:35
    
Hum, I did not know you could get free SSL certificates ! What's the catch ? Have you used them ? –  Wookai Jul 21 '10 at 19:42
1  
I have not used them myself so I don't really know. I was planning on trying one out for exactly the same reason you want to. They are only available for low level encryption and have less support among browsers and OSs. The one I linked to is now accepted in win7. –  Adam Jul 21 '10 at 19:49
add comment

4 Answers

up vote 15 down vote accepted

In general it is bad to use a self signed cert. If you do that then you are running the risk people will leave your site when they get a warning about your cert being bad. More important, you are running a larger risk of having someone do an injection attack where they use their own self-signed cert in the place of yours and the visitor will not know any better.

Check out the article here, http://www.sslshopper.com/article-when-are-self-signed-certificates-acceptable.html for a little more info on it.

As Adam suggested in the comments, I would try http://www.startssl.com/?app=1. If that doesn't suit your needs I know GoDaddy sells certs for as low as $24.99/yr here, http://www.godaddy.com/ssl/ssl-certificates.aspx.

share|improve this answer
add comment

As RandomBen said, self-signed certificates are generally frowned upon for the reasons he explained. But there is one situation in which they are fine: if the set of people who need to submit sensitive data to your website is small and limited, they are all somewhat technically competent, and you are able to communicate with all of them. In that case you can give each person the certificate details, then they can manually check the certificate when they go to your site and add a security exception if appropriate.

As an extreme example, on my personal VPS I have an administrative subdomain, which should only ever be accessed by me. There would be no problem securing that domain with a self-signed cert because I can manually check that the server certificate being used to secure the connection is the same one I installed on the server.

In cases where a self-signed cert won't work, the free StartSSL certificate that others have suggested might be a reasonable choice. I use one for the HTTPS version of my personal website (the main www domain). The reason they are able to offer the certificate for free is that when you register for the cert, they do only minimal (automated) checking to determine that you are who you say you are - basically they verify your email address by emailing you a verification code, and they verify that you own the domain by having you modify your index file (IIRC). The most significant downside of the free certificate is that, last I checked, Internet Explorer did not recognize StartCom as a root CA, so if you use a StartSSL certificate, visitors to your site who use IE will get a certificate warning. That does have the potential to push visitors elsewhere, so if you are running something like an e-commerce site, I'd suggest spending the money to get a certificate whose root CA will be recognized by all the major browsers.

(It's possible that recent versions of IE/Windows have added StartCom to the CA list, I'm not sure)

share|improve this answer
    
+1 for first paragraph. I use a self-signed certificate for Webmin on my server because it's only myself and designer that use it, but I wouldn't recommend doing it for general public use. –  DisgruntledGoat Jul 22 '10 at 10:58
add comment

If you are securing multiple subdomains, you might want to use wildcard certificates, which (depending on how many subdomains you are securing) could work out significantly cheaper than buying one per domain; for example RapidSSL has the wildcard getting cheaper than the individual certs once you have four domains in use.

share|improve this answer
add comment

It is not bad practice to use self-signed certificates. Self-signed certificates have a lot of practical purposes for which it simply doesn't make sense to use a CA-signed certificate.

For example, on many of my servers, I have passwordless login set up. These are servers that I connect to so frequently, and sometimes keep multiple SSH connections open to, that it's a hassle to type in my username and password every single time.

Instead, I use a self-signed SSL certificate that I generate on each of my client machines (a workstation at the office, a laptop, and my home workstation). This sort of setup allows me to use fairly long, secure, and completely unique passphrases for each of my servers without affecting productivity. And because I have direct access to the servers where I can install the public key for each certificate, there's no point in me using a CA-signed certificate.

I could set up my own root CA with which I can sign all of the internal-use certificates for our company, and this way I would only need to install a single public key on each server. However, our organization hasn't grown to the size that really necessitates this, and for the purposes of secure HTTP, this would still be the same as having a self-signed certificate.

Likewise, self-signed certificates are frequently used for email connections, PGP signature, and server-to-server connections where it's trivial to pre-exchange public keys. In many of these cases, this is actually more secure than relying on a certificate chain which could be compromised at any point in the chain.

share|improve this answer
    
I don't get why you are using SSL certificates in your case? You mention not wanting to type your password multiple times: you could simply use a SSH private key with ssh-agent, to automatically authenticate you on each server without having to type your password more than once. –  Wookai Feb 25 '12 at 7:37
    
@Wookai: That would be one way to do it for SSH, but using SSL client certificates is a much more general-purpose method of client authentication. I also use my client certificates for HTTPS authentication as well as email, and if I choose to set up an internal CA later, it becomes even more flexibile/powerful. At that point, I won't need to install individual private keys for every client/user. It's just a more robust solution IMO. –  Lèse majesté Feb 25 '12 at 8:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.