Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a .net developer and I'm currently working on moving the asp.net project from http to https.

I have worked my way through few tutorials and I'm wondering whether I have missed anything out.

So far:

I have installed and configured CA on the server. CA service is running fine but I'm not entirely sure whether it needs to be accessible from outside? I have a localhost/certsrv running to submit the certificate requests. Later I log onto the server and confirm/deny the requests.

On the same server I have configured an IIS. Confirmed the certificate that was generated by the CA service. Enabled anonymous authentication and set the password to be send in the clear text.

I'm not 100% on how the certificate works. Do I understand this correctly?

  1. I log onto the website: https\someaddress.domain\site
  2. There is a certificate that's associated with this website so the window comes up stating that this is an unknown certificate.
  3. I confirm that I want to view the website and the browsers takes me onto that website.

How does this improve the security when I transfer data between browser and the web server?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You have it right. The problem with a self-signed certificate is that it's not a signing authority that's included in your trusted root by default (hence the message that it's not a known provider). For some people, this isn't an issue (OWA comes to mind). However for businesses to conduct transactions on the web, you'll want one from a known authority (Verisign, GeoTrust, etc.) so that an HTTPS connection just happens and the user isn't prompted to make it happen.

As for improving security, hell yeah it does. It encrypts the traffic from the users browser to your server.

The CA does not have to be seen from the outside.

There are some things to remember also with self-signed certs. Because the browser asks for permission, unless you install it in the root, everytime you visit the site, it's fairly easy to lull your users into a false sense of security. What I mean is that because they'll get that message each time they visit your site, doing a little arp-poisoning and publishing a fake certificate is fairly easy and at that point your "encrypted" connection is owned.

share|improve this answer
    
Hi Greg. Thank you for your reply. I don't quite understand on how they could publish a fake certificate? Isn't each certificate identified by some sort of unique id or is it just done by its name? Does this also means that the web browser will have an access to the public key (encrypt only) and the server will have an access to private (?) key that can both encrypt and decrypt the data? Thank you –  vikp Aug 11 '10 at 15:03
    
@vikp - this thread over on SO contains some useful info for you: stackoverflow.com/questions/188266/… –  GregD Aug 11 '10 at 15:09
    
Thanks for the link, this makes a lot more sense now. Quoting "nsayer": Monkey-in-the-middle attacks are "impossible" unless the attacker has the private key of a trusted root certificate. Since the corresponding certificates are widely deployed, the exposure of such a private key would have serious implications for the security of eCommerce generally. Because of that, those private keys are very, very closely guarded. I guess this answers my question - man in the middle attacks are not possible if they don't have access to the private key. –  vikp Aug 11 '10 at 15:27
    
One caveat. Man-in-the-middle attacks ARE possible if you get the user to accept a new certificate. Which was the point I was trying to make. Most end-users don't understand how certs work, which is why you want one that doesn't ask you to accept. When you visit HTTPS for gmail for instance, it never asks you to accept the cert. If I try a man-in-the-middle attack on you, I pop up a fake cert when you visit HTTPS for gmail and if you accept it and log on, BAM, I own your connection from that point forward, including seeing all your traffic. –  GregD Aug 11 '10 at 15:51
    
In that particular case, I don't NEED the private cert, I just need to get you to accept the new certificate that I generated... –  GregD Aug 11 '10 at 15:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.