Is a Self Signed SSL certificate a false sense of security?
If you are being eavesdropped, the user will simply accept the certificate like he/she always does.
Interesting question, it depends on the use in my opinion. You're still protected in terms of the session is encrypted but you have no way of telling if it's the correct SSL cert presented to you unless you distribute your CA root cert to users/clients. For internal testing/dev projets this would work great, you generate a root CA certificate that you use distribute to your users (can be done via Group Policy in Windows and via openssl command line in Linux/BSD) and then use that root cert for signing your CSR's. Users will not see a warning or anything and you know the certificate is signed by your internal CA.
For external sites where you cannot assure this, I'd still say a self signed cert is better than no SSL at all if you are sending passwords or other sensitive information over the connection.
However, on the plus side there are plenty of very cheap "commercial" certificate issuers, GoDaddy being one of them. You can get a cert for about 40 euros per year. GoDaddy even offer free certs to OpenSource project web-sites.
|show 2 more comments|
I'm going to disagree, once on narrow technical grounds, and once on general grounds.
The narrow technical ground is that the OP asked about self-signed certificates, and several other answers refer to certificates signed by private CAs, which is a slightly different issue. But not very different, so that is really only a note in passing.
The major objection is that I think that as long as commercially-signed certificates are of more than trivial expense - and $40 a year is not a trivial expense for a lot of people on this planet - self-signed certificates have a major role to play in internet security, provided their limitations are recognised.
A self-signed certificate is like an ssh key from my
Self-signed certificates (and, for that matter, certificates signed by not-generally-valid CAs) are much better than no SSL at all, as long as people realise that unless they verify them they only secure the communication to themselves, the server at the other end of the DNS record, and any men-in-the-middle currently on the line. If they independently verify the certificate, then the authentication and encryption are at least as strong as that provided by a certificate signed by a recognised CA.
Moreover, those wishing to present the use of certificates signed by a recognised CA as the one-and-only internet security panacea may need to think hard about issues such as the inclusion of the Chinese Government's signing CA in the standard Mozilla bundle, and the fraudulent SSL certificates signed by Comodo.
For external sites, where the users don't have your CA certificate installed (which is the most common case), yes, a self-signed certificate gives a false sense of security, and thus it's worse than useless:
In other words, the level of protection is comparable to plain HTTP (except for on-the-wire sniffing: although the data are encrypted in transit, that is a rather anemic feature without endpoint verification), but the feeling of protection is unreasonably high. Bad car analogy: "I have ABS, so I can now drive safer in bad conditions" - except the ABS only exists in the car's sales brochure, without actually being present in the car.
Suggested reading: OWASP SSL Best practices
TL;DR: By using self-signed certificates on public-facing sites, you are making the Net a worse place, one clueless user at a time.
|show 1 more comment|
Depends. If you think it makes you more secure then it increases your risk as you choose to do riskier things with your false sense of security. If you treat it functionally equivalent to HTTP, then I'd say you are slightly more secure.
Without SSL/HTTPS anyone with wireshark on your network (or the local network of anyone logging in) can trivially listen in and capture username / passwords sent as plain text.
With self-signed SSL they cannot simply listen in, but now must fake your site, potentially alter DNS to do a man it the middle (MITM) attack. This is still a threat, but significantly more difficult for them to accomplish.
The other problem with using self-signed SSL is that many browsers treat self-signed certificates as a major security threat and warn you before entering (e.g., chrome) with a giant red page. http://www.sslshopper.com/article-ssl-certificates-in-google-chrome.html This could be a major inconvenience.
So bottom line is: if you run something that doesn't need to be particularly secure (e.g., no credit card data, no social security #s) and can't afford a proper certificate, a self-signed certificate could make some sense (to say prevent other network users from easily sniffing their login information).