Does Self-signed certificate differ from CA from a security point of view?

Question

I know that if I use self-signed cert, browsers will warn about it to the user, but I want to know that from security viewpoint is self-signed cert as secure as certificate authority(CA)?

Answer 1

Features

A self-signed certificate is capable of having the same security features (encryption, extended validation, permitted usage) as a certificate issued from a leading issuer such as VeriSign or GeoTrust. These options need to be set when the certificate is created.

Trust

However the purpose and the advantage of Public Key Infrastructure (PKI) (such as Internal Certificate Authority used inside an enterprise, VeriSign/Symantec, GeoTrust, and many more) is that there is an existing trust relationship between the client and the certificate issuer (e.g. VeriSign). The client (people and browser) trusts that the issuer has checked you out and has verified you are who you say you are. Certificate issuers have stringent security practises that they have to maintain. This type of relationship is not replicated with a self-signed certificate.

You can install a self-signed certificate into a browser (needs to be done for each browser) to make it recognise the certificate as trusted.

If you do not do this step the user has no way of knowing the certificate has changed unless they manually inspect the certificate. This could be dangerous because someone could intercept the transmission (man-in-the-middle) and the user would not know the certificate/host was the wrong one.

Summary

When looking at functionality alone, a self-signed certificate offers neither more or less security then one issued from a leading certificate authority.

Websites are for users, and a certificate trust is important so the user knows your website is who it says it is.

My personal opinion is that the trust and ease of deployment gained by using a public issuing authority is very important for a public web site, especially if you don’t have an existing close relationship with the people visiting it.

A self-signed certificate may be suitable for limited internal development / testing.

An internal Certificate Authority for use is a good solution for enterprises who use certificates internally and have an expertise in PKI.

Hope that helps

Answer 2

It's not secure, because it makes you vulnerable to a redirection or man-in-the-middle attack. Any attacker can create a self-signed certificate for your domain, and your users won't be able to tell that they've received the wrong one if they're taken to the attacker's site instead of yours.

Answer 3

As you already said, the browser will issue a warning to the user. This makes it possible to man-in-the-middle the connection. Certificates are about trust and your self-signed certificate lacks the trust-chain you normally get with a CA-signed cert. Consider this: if the client is going through my router to connect to your website, I can intercept the communication, generate a cert on the fly (for the client) and talk to your server using your cert. It would still look the same for the client but on my router I have the unencrypted traffic.

Answer 4

When we talk about security, self-signed and CA signed certificates are providing same 256-bit encryption to your website. But, SSL is not only used for security, but also refer authentication and users trust.

Drawbacks of Self-Signed Certificate,

Self-signed certificate and signed certificate carry equal encryption strength but beside this encryption, a self-signed certificate holder will have few drawback of using self-signed certificate.

• Self-signed certificate is ideal for internal testing purpose while signed certificate can be used for internal and external environments.

• Self-signed certificate does not support PKI (public key infrastructure) that builds the trust between the user and the certificate issuer by ensuring the user that a particular signed certificate is valid and offered from reputed CA (certificate authority).

• Browser will throw a warning while encountering with self-signed certificate on contrary, signed certificate have already their root certificates implemented in browser hence, there will be no issue of browser warning during the visit of a website.

• If you are dealing with eCommerce, financial, banking website, then users will not trust self-signed certificate, in that case, you need to go with signed certificate.

• You cannot revoke the self-signed certificate. If a private key of a self-signed certificate is compromised, then attackers can easily customize the certificate.

• If any attacker performs man-in-the-middle attack, a user interacting with the browser could not know that the certificate is changed and used by the attacker until the user inspects the certificate manually. Attacker thus can sniff ongoing transactions details.

• When users face security warnings due to self-signed certificate they may understand that the website is not capable of securing their personal information and they would move away from the site.

• While dealing with self-signed certificate on internal environment, employees are advised to ignore security warnings as a result, they tend to ignore warning in long run even on browsing public sites which may left the organization vulnerable.

Self-signed certificate is available at free while you need to pay few buck for signed certificate. Overall, you will have authenticity, trust, and encryption with signed certificate that can be a great advantage for any online business website.

Please read this article my company published to know more about the risks in self-signed certificates.

Answer 5

If all your users know you and are confident in you, you can build your own CA for free. OpenSSL for example offers you all you need for that:

• you first build a self signed root certificate
• you optionally use that root certificate to sign an intermediary certificate that you use in following steps or directly use the root
• you send that certificate to all your users asking them to put it in the list of their trusted authorities
• you use it to sign site certificates.

The difference is only legal. If you own the CA and the site there is no trusted third party.

Answer 6

As trust in PKI is somehow broken (comodo etc...), CA signed certificates show give you no popups :)

For internal usage there's no need for CA signed certs.

Answer 7

The funny part of all this is that in all the hosting companies I have worked for I have NEVER HEARD OF Verisign, Comodo, or any other Certificate Authority calling to check the information provided by their customer is true. They check that the credit card charges properly, and might check that the billing address matches what the customer said TO BILL THE CREDIT CARD, but NOT to issue a certificate. So while the 'trusted relationship' is implied, it is rarely ACTUALLY THERE! Yep, generating your own cert is ok for internal stuff, but for public facing stuff, where customers will be buying, you need to use a public certificate authority issued certificate. Customers don't understand any of this, nor should they have to, but they are trusting that the Verisign company is trustable (even though they don't check certs before issueing them, they're made by a computer..not a human). Hope this helps.

Answer 8

It is the CA's role to deliver certificates to the various users. If the CA is compromised, any certificate from that CA will be revoked, i.e. it will be invalidated.